Is CVE-2026-10055 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10055 being exploited in the wild.

How severe is CVE-2026-10055?

High severity, with a CVSS score of 8.5, published 3 July 2026.

Which products and versions are affected?

Eclipse Foundation Theia >= 1.26.0, < 1.73.0.

Is there a fix for CVE-2026-10055?

A patch was published on 2026-07-03: Fixed in version 1.73.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10055 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10055?

Check whether you run Eclipse Foundation Theia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10055: Eclipse Theia SSRF in request-service RPC

Q: Is there a fix for CVE-2026-10055?

A patch was published on 2026-07-03: Fixed in version 1.73.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-10055 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-10055?

Check whether you run Eclipse Foundation Theia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10055 · Severity: high · CVSS 8.5 · Published 2026-07-03

Eclipse Theia, a platform for building IDEs and tools, contains a vulnerability that allows users to force the server to make unauthorized network requests. An attacker with access to the application can use this to probe internal company networks, access private administrative interfaces, or steal sensitive cloud metadata that is normally hidden from the internet. This is particularly dangerous for multi-tenant or public-facing development environments where users are not fully trusted.

Technologies: Eclipse Foundation Theia. Vendors: Eclipse Foundation.

Quick answers

Is CVE-2026-10055 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10055 being exploited in the wild.
How severe is CVE-2026-10055?: High severity, with a CVSS score of 8.5, published 3 July 2026.
Which products and versions are affected?: Eclipse Foundation Theia >= 1.26.0, < 1.73.0.
Is there a fix for CVE-2026-10055?: A patch was published on 2026-07-03: Fixed in version 1.73.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10055 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10055?: Check whether you run Eclipse Foundation Theia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Eclipse Theia's '/services/request-service' RPC endpoint. The backend 'BackendRequestFacade' accepts an attacker-controlled URL from any client connected to the standard messaging endpoint, performs the HTTP request server-side, and returns the full base64-encoded response body to the caller. Because the destination URL is not validated or allowlisted, a remote attacker with low privileges can bypass network boundaries to access localhost services, internal APIs, or cloud instance metadata services (IMDS). The vulnerability is present in versions 1.26.0 through 1.72.x and is fixed in version 1.73.0.

Affected products

Eclipse Foundation Theia >= 1.26.0, < 1.73.0

Timeline

2026-07-03: disclosed
2026-07-03: advisory
2026-07-03: patched: Fixed in version 1.73.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.