# CVE-2026-16454: Eclipse hawkBit privilege escalation in DDI Controller

Source: https://junglewise.ai/threats/cve-2026-16454-eclipse-hawkbit-privilege-escalation-in-ddi-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-16454 · Severity: medium · CVSS 4.3 · Published 2026-07-21

Eclipse hawkBit is a framework used to manage software and firmware updates for IoT devices. A security flaw in the Direct Device Integration (DDI) component allows an authenticated device to download firmware updates that were not specifically assigned to it. While an attacker must already have valid device credentials, they could use this vulnerability to access and exfiltrate any firmware artifacts belonging to the same organization or 'tenant.'

Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-16454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16454 being exploited in the wild.

**How severe is CVE-2026-16454?** Medium severity, with a CVSS score of 4.3, published 21 July 2026.

**Which products and versions are affected?** Eclipse Foundation hawkBit <= 1.0.3; org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) <= 1.0.3, ECOSYSTEM:introduced=0,fixed=1.0.4.

**Is there a fix for CVE-2026-16454?** Yes. org.eclipse.hawkbit:hawkbit-ddi-resource (Maven): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16454 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16454?** Check whether you run Eclipse Foundation hawkBit or org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.eclipse.hawkbit:hawkbit-ddi-resource (Maven): upgrade to 1.0.4 or later

  ```sh
  # set org.eclipse.hawkbit:hawkbit-ddi-resource to 1.0.4 in your pom.xml or build.gradle
  ```


## Technical details

A privilege escalation vulnerability (CWE-284 / CWE-862) exists in the Direct Device Integration (DDI) Controller of Eclipse hawkBit. The flaw is rooted in improper object-level authorization validation within the `hawkbit-ddi-resource` component. While authentication is required, the system fails to verify if a specific firmware artifact is explicitly assigned to the requesting device before allowing a download. An attacker with valid device credentials can enumerate available firmware via a metadata endpoint and subsequently download any artifact within their tenant's scope. This issue is resolved in version 1.0.4 by enforcing assignment-based verification on all download requests.

## Affected products

- Eclipse Foundation hawkbit-ddi-resource <= 1.0.3

## Identifiers

- CVE-2026-16454
- GHSA-92r3-p8c2-3fpx

## Timeline

- 2026-06-26: advisory: GitHub security advisory published
- 2026-07-21: disclosed: CVE published to NVD

## References

- [https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx](https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196)

## Related threats

- [Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration](https://junglewise.ai/threats/duplicate-advisory-privilege-escalation-in-eclipse-hawkbit-ddi-allows-3dd6a829)