{"id":"CVE-2026-82958","details":"In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON \"thing\" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.\n\n\n\n\nWhen a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.\n\n\n\n\nExploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.","aliases":["GHSA-cgfq-3fv9-5c44"],"modified":"2026-09-04T03:47:19.726702023Z","published":"2026-09-02T10:12:49.085Z","database_specific":{"cna_assigner":"eclipse","cwe_ids":["CWE-116","CWE-1336","CWE-74"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82958.json"},"references":[{"type":"WEB","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/764"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82958.json"},{"type":"ADVISORY","url":"https://github.com/eclipse-ditto/ditto/security/advisories/GHSA-cgfq-3fv9-5c44"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82958"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/eclipse-ditto/ditto","events":[{"introduced":"8e2b2ed4c3ccfb4aa6bd7d7325118888907e3be5"},{"last_affected":"2ca2fc1d5cf5db11a6b8c18f31f51bb9ee8469d5"}],"database_specific":{"extracted_events":[{"introduced":"1.3.0"},{"last_affected":"3.9.6"}],"source":"AFFECTED_FIELD"}}],"versions":["helm-chart-4.6.0","3.9.6","helm-chart-4.5.0","3.9.5","helm-chart-4.4.0","3.9.4","helm-chart-4.3.0","3.9.3","helm-chart-4.2.0","3.9.2","helm-chart-4.1.0","3.9.1","helm-chart-4.0.0","3.9.0","3.9.0-M6","3.9.0-M5","3.9.0-M4","3.9.0-M3","3.9.0-M2","3.9.0-M1","3.8.0","3.8.0-M6","3.8.0-M5","3.8.0-M4","3.8.0-M3","3.8.0-M2","3.8.0-M1","3.7.0","3.6.0","3.5.0","3.4.0","3.4.0-M2","3.4.0-M1","3.3.4","3.3.3","3.3.2","3.3.2-M1","3.2.0","3.1.0","3.1.0-M1","3.0.0","2.3.2","2.4.0","2.4.0-M1","2.3.1","2.3.0","2.2.0","2.1.0","2.1.0-M3","2.1.0-M2","2.1.0-M1","2.0.0","2.0.0-M2","2.0.0-M1","1.4.0","1.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82958.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}