Executive brief
Eclipse CSI - PIA, an authentication broker used to manage security tokens, contains a flaw that allows unauthorized users to manipulate system logs. By sending a specially crafted request, an attacker can insert fake 'successful authentication' entries into the audit trail. This undermines the reliability of the system's logs, making it difficult for security teams to accurately investigate incidents or verify who has actually accessed the system.
Technical details
A log injection vulnerability (CWE-117) exists in the /v1/upload/sbom endpoint of Eclipse CSI - PIA. The application extracts the 'iss' claim from a user-provided JSON Web Token (JWT) without verifying the cryptographic signature. This claim is then interpolated into log statements before any validation occurs. Because the logging configuration renders newline characters literally, a remote, unauthenticated attacker can inject malicious strings containing newlines to forge log entries. These forged entries can be made identical to legitimate 'Successfully authenticated project' messages, effectively corrupting the audit trail used for incident response. The vulnerability is present in versions up to and including 0.2.1.
Affected products
- Eclipse Foundation Eclipse CSI - PIA <=0.2.1
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory