# CVE-2026-10055: Eclipse Theia SSRF in request-service RPC

Source: https://junglewise.ai/threats/cve-2026-10055-eclipse-theia-ssrf-in-request-service-rpc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-10055 · Severity: high · CVSS 8.5 · Published 2026-07-03

Eclipse Theia, a platform for building IDEs and tools, contains a vulnerability that allows users to force the server to make unauthorized network requests. An attacker with access to the application can use this to probe internal company networks, access private administrative interfaces, or steal sensitive cloud metadata that is normally hidden from the internet. This is particularly dangerous for multi-tenant or public-facing development environments where users are not fully trusted.

Technologies: [Eclipse Foundation Theia](https://junglewise.ai/threats/technologies/theia). Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation).

## Quick answers

**Is CVE-2026-10055 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10055 being exploited in the wild.

**How severe is CVE-2026-10055?** High severity, with a CVSS score of 8.5, published 3 July 2026.

**Which products and versions are affected?** Eclipse Foundation Theia >= 1.26.0, < 1.73.0.

**Is there a fix for CVE-2026-10055?** A patch was published on 2026-07-03: Fixed in version 1.73.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10055 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10055?** Check whether you run Eclipse Foundation Theia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Eclipse Theia's '/services/request-service' RPC endpoint. The backend 'BackendRequestFacade' accepts an attacker-controlled URL from any client connected to the standard messaging endpoint, performs the HTTP request server-side, and returns the full base64-encoded response body to the caller. Because the destination URL is not validated or allowlisted, a remote attacker with low privileges can bypass network boundaries to access localhost services, internal APIs, or cloud instance metadata services (IMDS). The vulnerability is present in versions 1.26.0 through 1.72.x and is fixed in version 1.73.0.

## Affected products

- Eclipse Foundation Theia >= 1.26.0, < 1.73.0

## Timeline

- 2026-07-03: disclosed
- 2026-07-03: advisory
- 2026-07-03: patched: Fixed in version 1.73.0

## References

- [https://github.com/eclipse-theia/theia/security/advisories/GHSA-2m57-xxmh-v696](https://github.com/eclipse-theia/theia/security/advisories/GHSA-2m57-xxmh-v696)
- [https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/446](https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/446)

## Related threats

- [Eclipse Theia remote command execution via cross-origin WebSocket access](https://junglewise.ai/threats/cve-2026-10054-eclipse-theia-remote-command-execution-via-cross-origin-websocket)
- [Eclipse Theia indirect prompt injection in AI agent system prompts](https://junglewise.ai/threats/cve-2026-46580-eclipse-theia-indirect-prompt-injection-in-ai-agent-system)
- [Eclipse Theia arbitrary command execution via untrusted workspace tasks](https://junglewise.ai/threats/cve-2026-44691-eclipse-theia-arbitrary-command-execution-via-untrusted-workspace)
- [Eclipse Theia indirect prompt injection in AI chat agent](https://junglewise.ai/threats/cve-2026-44688-eclipse-theia-indirect-prompt-injection-in-ai-chat-agent)
- [Eclipse Theia data exfiltration via Markdown image rendering in AI chat](https://junglewise.ai/threats/cve-2026-22551-eclipse-theia-data-exfiltration-via-markdown-image-rendering-in)