CVE-2026-10055

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.26.0 and later

Description The backend /services/request-service RPC accepts a URL controlled by an attacker from any client connected to the standard /services messaging endpoint. The server performs the HTTP request and returns the full response body to the caller. Since the destination URL is not validated or allowlisted, a remote attacker with access to the service connection can execute server-side HTTP requests to localhost or other reachable backend hosts. This can expose internal administrative endpoints, cloud instance metadata services, and other resources located outside the browser network boundary. This issue primarily affects multi-tenant or publicly-reachable deployments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.