Vulnerabilidades do Eclipse Foundation Eclipse Connected Services Platform
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Eclipse Foundation Eclipse Connected Services Platform: 3 registro(s), com versões afetadas e correções.
CVE-2026-110724
Desconhecida
CWE-269 15/10/2026
Improper Privilege Management em Eclipse Foundation Eclipse Connected Services Platform
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
CVE-2026-110723
Alta · 7.5
CWE-290 15/10/2026
Authentication Bypass by Spoofing em Eclipse Foundation Eclipse Connected Services Platform
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
CVE-2026-110726
Média · 6.5
CWE-348 15/10/2026
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver…
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.