Is CVE-2026-16454 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16454 being exploited in the wild.

How severe is CVE-2026-16454?

Medium severity, with a CVSS score of 4.3, published 21 July 2026.

Which products and versions are affected?

Eclipse Foundation hawkBit <= 1.0.3; org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) <= 1.0.3, ECOSYSTEM:introduced=0,fixed=1.0.4.

Is there a fix for CVE-2026-16454?

Yes. org.eclipse.hawkbit:hawkbit-ddi-resource (Maven): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16454 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16454?

Check whether you run Eclipse Foundation hawkBit or org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16454: Eclipse hawkBit privilege escalation in DDI Controller

Q: Is there a fix for CVE-2026-16454?

Yes. org.eclipse.hawkbit:hawkbit-ddi-resource (Maven): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-16454 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-16454?

Check whether you run Eclipse Foundation hawkBit or org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16454 · Severity: medium · CVSS 4.3 · Published 2026-07-21

Eclipse hawkBit is a framework used to manage software and firmware updates for IoT devices. A security flaw in the Direct Device Integration (DDI) component allows an authenticated device to download firmware updates that were not specifically assigned to it. While an attacker must already have valid device credentials, they could use this vulnerability to access and exfiltrate any firmware artifacts belonging to the same organization or 'tenant.'

Vendors: Eclipse Foundation, Maven.

Quick answers

Is CVE-2026-16454 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16454 being exploited in the wild.
How severe is CVE-2026-16454?: Medium severity, with a CVSS score of 4.3, published 21 July 2026.
Which products and versions are affected?: Eclipse Foundation hawkBit <= 1.0.3; org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) <= 1.0.3, ECOSYSTEM:introduced=0,fixed=1.0.4.
Is there a fix for CVE-2026-16454?: Yes. org.eclipse.hawkbit:hawkbit-ddi-resource (Maven): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16454 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16454?: Check whether you run Eclipse Foundation hawkBit or org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.eclipse.hawkbit:hawkbit-ddi-resource (Maven): upgrade to 1.0.4 or later

# set org.eclipse.hawkbit:hawkbit-ddi-resource to 1.0.4 in your pom.xml or build.gradle

Technical details

A privilege escalation vulnerability (CWE-284 / CWE-862) exists in the Direct Device Integration (DDI) Controller of Eclipse hawkBit. The flaw is rooted in improper object-level authorization validation within the `hawkbit-ddi-resource` component. While authentication is required, the system fails to verify if a specific firmware artifact is explicitly assigned to the requesting device before allowing a download. An attacker with valid device credentials can enumerate available firmware via a metadata endpoint and subsequently download any artifact within their tenant's scope. This issue is resolved in version 1.0.4 by enforcing assignment-based verification on all download requests.

Affected products

Eclipse Foundation hawkbit-ddi-resource <= 1.0.3

Identifiers

CVE-2026-16454
GHSA-92r3-p8c2-3fpx

Timeline

2026-06-26: advisory: GitHub security advisory published
2026-07-21: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.