Executive brief
Eclipse CSI - PIA, a tool used for managing software bills of materials (SBOMs), contains a security flaw in how it verifies identity tokens. An attacker can bypass security checks by providing a specially crafted web address that appears legitimate but actually points to a server they control. This allows the attacker to trick the system into accepting fraudulent data or making unauthorized connections to external servers.
Technical details
The vulnerability exists in the `is_issuer_known` function within `pia/models.py` of Eclipse CSI - PIA. The application uses a simple `startswith()` string check to validate OIDC issuers (e.g., checking for 'https://ci.eclipse.org') rather than performing proper host-bounded URL validation. An unauthenticated attacker can exploit this by providing a malicious issuer URL using 'userinfo' or 'suffix' tricks (e.g., 'https://ci.eclipse.org.evil.host'). This allows the attacker to trigger a Server-Side Request Forgery (SSRF) during OIDC discovery and JWKS fetching, ultimately leading the application to accept a JWT signed with the attacker's own keys via the `/v1/upload/sbom` endpoint.
Affected products
- Eclipse Foundation Eclipse CSI - PIA <=0.3.0
Timeline
- 2026-07-02: disclosed: Initial publication of the CVE record.
- 2026-07-02: advisory