{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-14336",
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"state": "PUBLISHED",
"assignerShortName": "eclipse",
"dateReserved": "2026-07-01T12:59:37.189Z",
"datePublished": "2026-07-02T08:29:16.010Z",
"dateUpdated": "2026-07-02T12:26:16.287Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse",
"dateUpdated": "2026-07-02T08:29:16.010Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Eclipse Foundation",
"product": "Eclipse CSI - PIA",
"repo": "https://github.com/eclipse-csi/pia",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "0.3.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix check while pointing the OIDC discovery and JWKS fetches at a server the attacker controls. An unauthenticated caller of POST /v1/upload/sbom can use this to force PIA to make outbound HTTP(S) requests to an arbitrary attacker-chosen host, and to have oidc.verify_token accept a JWT signed with the attacker's own key.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith('https://ci.eclipse.org') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix check while pointing the OIDC discovery and JWKS fetches at a server the attacker controls. An unauthenticated caller of POST /v1/upload/sbom can use this to force PIA to make outbound HTTP(S) requests to an arbitrary attacker-chosen host, and to have oidc.verify_token accept a JWT signed with the attacker's own key."
}
]
}
],
"references": [
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/154"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseSeverity": "HIGH",
"baseScore": 8.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
}
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-07-02T12:26:02.672416Z",
"id": "CVE-2026-14336",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-07-02T12:26:16.287Z"
}
}
]
}
}