CVE-2026-82958

Name of the Vulnerable Software and Affected Versions Eclipse Ditto versions 1.3.0 through 3.9.6

Description The ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values resolved from inbound message headers into a pre-configured JSON thing template as raw, un-escaped strings. Since the placeholder engine does not perform JSON escaping, a value containing a double-quote character can break the string context and inject additional JSON structure. If a connection uses this mapper with a template reflecting a header controllable by a publishing device (such as MQTT 5 user properties, AMQP 1.0 application properties, or Kafka record headers), an attacker can inject an inline policy object. This allows the attacker to override the administrator-configured policyId and assign an arbitrary access-control policy to the newly created digital twin, potentially granting full read/write access and revoking the legitimate owner's access without administrator interaction.

Recommendations Update Eclipse Ditto to a version later than 3.9.6. As a temporary mitigation, restrict the connection's subjects to thing creation only via the entity-creation configuration to prevent policy-override impacts.