Executive brief
Eclipse Theia, a platform for building IDEs and tools, contains a vulnerability that allows users to force the server to make unauthorized network requests. An attacker with access to the application can use this to probe internal company networks, access private administrative interfaces, or steal sensitive cloud metadata that is normally hidden from the internet. This is particularly dangerous for multi-tenant or public-facing development environments where users are not fully trusted.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Eclipse Theia's '/services/request-service' RPC endpoint. The backend 'BackendRequestFacade' accepts an attacker-controlled URL from any client connected to the standard messaging endpoint, performs the HTTP request server-side, and returns the full base64-encoded response body to the caller. Because the destination URL is not validated or allowlisted, a remote attacker with low privileges can bypass network boundaries to access localhost services, internal APIs, or cloud instance metadata services (IMDS). The vulnerability is present in versions 1.26.0 through 1.72.x and is fixed in version 1.73.0.
Affected products
- Eclipse Foundation Theia >= 1.26.0, < 1.73.0
Timeline
- 2026-07-03: disclosed
- 2026-07-03: advisory
- 2026-07-03: patched: Fixed in version 1.73.0