CVE-2026-61891

Executive Summary

CVE-2026-61891 is a high-severity arbitrary file read vulnerability affecting the Eclipse Theia IDE framework, specifically in versions up to and including 1.73.1. The flaw resides in the @theia/filesystem backend's HTTP file-serving endpoints (GET /file, GET /files/, PUT /files/), which fail to confine client-supplied URI paths to the workspace root and additionally fail to enforce the connection token on HTTP requests in browser deployments. An unauthenticated remote attacker can exploit this to read any file accessible by the backend process, including /etc/passwd, SSH private keys, cloud credentials, or environment variables containing secrets. With a CVSS score of 7.5 (High) and a low EPSS score (0.00457), this vulnerability is not yet widely exploited but represents a critical information disclosure risk for any organization running browser-based Eclipse Theia instances.

Technical Analysis

The vulnerability combines two distinct weaknesses in the Eclipse Theia architecture: insufficient path confinement and broken authentication enforcement on HTTP endpoints.

Root Cause 1: Missing Path Validation

The @theia/filesystem package registers HTTP routes that convert a client-supplied uri query parameter directly into a filesystem path using Node.js fs operations. The handler logic can be summarized as:

// @theia/filesystem/src/node/file-system-server.ts (simplified)
this.httpServer.route('GET', '/file', async (request, response) => {
    const uri = new URI(request.url.query.uri);
    const filePath = uri.path.toString(); // No workspace confinement
    const stream = fs.createReadStream(filePath);
    stream.pipe(response);
});

There is no check ensuring the resolved path starts with the workspace root or any allow-listed directory. The path.normalize() call (if any) does not prevent directory traversal using .. sequences because the URI is fully attacker-controlled. For example, GET /file?uri=file:///etc/hosts resolves to /etc/hosts and streams its contents directly. This is a classic CWE-22 (Path Traversal) vulnerability, though the traversal vector is inherent to the design — the server never validates the canonical path against an allowed root.

Root Cause 2: Token Bypass on HTTP Middleware

In browser (non-Electron) deployments, Eclipse Theia uses a token-based authentication mechanism. The token is issued as a cookie during WebSocket upgrade handshakes. However, the HTTP middleware in @theia/core has a critical flaw: it re-issues the cookie on every HTTP request and calls next() unconditionally, even when no token is present. The relevant code path:

// @theia/core/src/node/backend-server.ts (simplified)
httpServer.use((request, response, next) => {
    if (request.headers.cookie?.includes('theia-token')) {
        // Validate token — but missing branch for no-token case
    }
    // Token is re-issued; next() is always called
    response.setHeader('Set-Cookie', `theia-token=${generateToken()}`);
    next(); // No rejection for tokenless requests
});

Because next() is called regardless of whether a valid token exists, HTTP requests to /file, /files/, and /files/ bypass authentication entirely. An attacker does not need to steal a session cookie — simply sending a tokenless HTTP request is sufficient. Electron mode uses a separate ElectronSecurityToken passed via command line and is not affected by this specific path.

Affected Attack Surface

• Eclipse Theia versions <= 1.73.1 (browser mode only)
• The @theia/filesystem and @theia/core Node.js packages
• Any downstream product built on Theia (e.g., Gitpod's older self-hosted distributions, Eclipse Cloud DevTools, VS Code-like web IDEs)

The vulnerability requires network access to the Theia instance's HTTP port (typically 3000 or 8080). No authentication, user interaction, or special privileges are needed. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms a network-reachable, unauthenticated, low-complexity attack with high confidentiality impact and no integrity/availability impact.

Exploitation Scenarios

Attack Chain: Unauthenticated Arbitrary File Read

1. Reconnaissance: An attacker identifies a target running Eclipse Theia in browser mode. They scan for exposed ports using Shodan or masscan: http.title:"Theia" or http.component:"Theia" returns instances. Confirm the target is browser mode by checking the login page for absence of Electron-specific markers (no ?electronToken= query parameter).

2. Token Bypass Verification: The attacker sends a minimal HTTP request without any cookie header:

   GET / HTTP/1.1
   Host: target:3000
   

   The response includes a Set-Cookie: theia-token=... header but returns HTTP 200 (not 401/403). This confirms the middleware does not block tokenless requests.

3. Path Traversal Trigger: The attacker crafts a request targeting the vulnerable file-serve endpoint:

   GET /file?uri=file:///etc/passwd HTTP/1.1
   Host: target:3000
   Connection: close
   

   The uri parameter is parsed as a file:// URI, converted directly to /etc/passwd, and streamed back. The response body contains the entire contents of the file.

4. Sensitive File Enumeration: The attacker iterates through common targets:

   • file:///etc/shadow (if readable)
   • file:///home/ubuntu/.ssh/id_rsa (SSH private key)
   • file:///etc/ssl/private/ssl-cert-snakeoil.key (TLS keys)
   • file:///proc/self/environ (environment variables — typically contains workspace tokens, cloud keys)
   • file:///root/.aws/credentials (AWS secrets)
   • file:///var/run/secrets/kubernetes.io/serviceaccount/token (K8s service account token)

5. Post-Exploitation: The attacker uses harvested credentials for lateral movement:

   • SSH into the host using leaked id_rsa keys
   • Decrypt TLS traffic with private server keys
   • Authenticate against cloud APIs with environment-stored tokens
   • Escalate privileges within containerized environments using service account tokens

Variant: Workspace-Local File Exfiltration

Even if the attacker has a valid authenticated session (e.g., via compromised credentials), they can exfiltrate files outside the workspace by supplying uri=file:///etc/hosts instead of a workspace-relative path. This bypasses the intended workspace boundary, enabling a low-privileged user to steal host-level secrets.

Impact Assessment

Business Impact

• Confidentiality Breach (High): The CVSS subscore for confidentiality impact is C:H. An attacker gains read access to any file readable by the Theia backend process. In typical Kubernetes deployments, this includes the POD's service account token, enabling cluster-level compromise.
• Company-wide data exposure: If Theia is used as a shared development environment (common in GitOps / cloud IDE setups), a single unauthenticated request can expose:
  • Source code repositories (premature IP theft)
  • Database connection strings
  • CI/CD pipeline secrets
  • Customer data mounted as volumes

Affected Systems

• All Eclipse Theia versions ≤ 1.73.1 in browser mode (the default for web deployments)
• Downstream products: Gitpod (self-hosted < 2023 versions), Eclipse Cloud DevTools, Theia-based commercial IDEs (e.g., Arm's Keil Studio Cloud)
• PaaS/SaaS offerings that embed Theia as web-based IDE

Blast Radius

• Direct: Filesystem content of the host/container running Theia
• Indirect: If the backend service account has broad IAM permissions (common in dev environments), the leakage can extend to cloud object storage, Kubernetes secrets, and connected databases
• Lateral movement: SSH keys and cloud tokens harvested enable attacker pivots into otherwise protected infrastructure

CVSS Analysis

The score of 7.5 (High) reflects AV:N/AC:L/PR:N/UI:N — network exploitability with no authentication or user interaction. The absence of integrity/availability impact (I:N/A:N) keeps the score below 9.0, but the information disclosure is sufficient for complete system compromise in multi-tenant environments.

Detection Guidance

Sigma Rule

title: Eclipse Theia Unauthenticated File Read Attempt
id: 8f2c9e31-b0a9-4ec5-8a7f-1d3c2e5b6a90
status: experimental
description: Detects attempts to exploit CVE-2026-61891 by requesting file URLs on Eclipse Theia /file endpoints
author: ValtersIT Threat Intelligence
date: 2026/11/14
logsource:
  category: webserver
  product: nginx
  detection:
    selection:
      cs-method: 'GET'
      cs-uri-query|contains:
        - '/file?uri=file:///'
        - '/files/?uri=file:///'
        - '/files/?uri=file:///'
    condition: selection
  falsepositives:
    - Legitimate workspace downloads using file:// protocol (rare)
    - Monitoring tools that check for directory traversal patterns
  level: high

YARA Rule

rule Eclipse_Theia_CVE_2026_61891_FileRead {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects HTTP requests exploiting unauthenticated file read in Eclipse Theia"
        cve = "CVE-2026-61891"
        date = "2026-11-14"
    strings:
        $file_endpoint_a = "/file?uri=" ascii wide nocase
        $file_endpoint_b = "/files/?uri=" ascii wide nocase
        $file_endpoint_c = "/files/?uri=" ascii wide nocase
        $file_proto = "file:///" ascii wide nocase
        $sensitive_path = "/etc/" ascii wide nocase
        $home_path = "/home/" ascii wide nocase
        $proc_path = "/proc/" ascii wide nocase
    condition:
        (any of ($file_endpoint*)) and ($file_proto) and (any of ($sensitive_path, $home_path, $proc_path))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Eclipse Theia CVE-2026-61891 File Read Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/file"; depth:5; http.uri; content:"uri=file:///"; http.uri; pcre:"/\/(?:etc|home|proc|root|var\/run)\//Ui"; classtype:attempted-recon; sid:2061891; rev:1; reference:cve,2026-61891;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [network where event.type == "start" and destination.port in (3000, 8080) and 
   dns.question.name like "*.theia*" ]
  [http where http.request.method == "GET" and 
   (url.path == "/file" or url.path == "/files/" or url.path == "/files/") and 
   url.query contains "uri=file:///" and
   (url.query contains "/etc/" or url.query contains "/home/" or url.query contains "/proc/")]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="GET"
| search url_path="/file" OR url_path="/files/" OR url_path="/files/"
| search uri*="file:///*"
| rex field=url_query "uri=file:///(?<target>.*)"
| where match(target, "^(etc|home|proc|root|var)/")
| stats count by src_ip, url_path, target, status
| table _time, src_ip, url_path, target, status, count

Wazuh OSSEC Rule

<group name="eclipse_theia,">
  <rule id="100391" level="12">
    <decoded>wazuh</decoded>
    <field name="url">\.|/file\?uri=file:///</field>
    <field name="url">\.|/files/\?uri=file:///</field>
    <field name="url">\.|/files/\?uri=file:///</field>
    <description>Eclipse Theia CVE-2026-61891 file read attempt detected on $(url)</description>
    <group>webserver_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). NVD indicates a fix exists in version 1.73.2, but this must be verified against the vendor's release notes before deployment.

1. Immediate Mitigations (until patch verified)

• Reverse proxy path restriction: Place an nginx/Apache layer in front of Theia and block HTTP methods/routes matching /file, /files/, and /files/ when the URI contains file:///. Example nginx snippet:

  location ~ ^/(file|files)/$ {
      if ($arg_uri ~ "^file:///") { return 403; }
      proxy_pass http://theia-backend:3000;
  }
  

• Network segmentation: Restrict access to the Theia HTTP port (default 3000) to only authorized networks/VPNs using firewall rules.
• Disable browser mode: If Electron mode is feasible, switch to it — Electron uses ElectronSecurityToken and is not affected via this path.
• Filesystem isolation: Run Theia in a container with a read-only root filesystem (readOnlyRootFilesystem: true) and mount only the workspace as a volume. This limits the blast radius to workspace files.

2. Patch/Upgrade Steps

• Upgrade Eclipse Theia to version 1.73.2 (or later) when the fix is confirmed in the official changelog.
• For npm-managed projects, run:

  npm view @theia/filesystem versions  # check available versions
  npm install @theia/filesystem@latest --save
  

• For yarn:

  yarn add @theia/filesystem@latest
  

• For pnpm:

  pnpm add @theia/filesystem@latest
  

• Verify the fix by retesting the exploit vector after upgrade. A proper patch must (a) confine resolved paths to the workspace root using path.resolve() + prefix check, and (b) reject HTTP requests lacking a valid token in the middleware (return 401 instead of calling next()).

3. Long-Term Hardening

• Apply the principle of least privilege to the backend service account: use a non-root user with read access only to the workspace mount.
• Implement zero-trust network access for the Theia control plane; never expose IDE endpoints directly to the internet.
• Enable audit logging for all file access in the container/host filesystem to detect post-exploitation reads.
• Subscribe to the Eclipse Security Advisories mailing list to receive early notice of similar path-traversal or auth-bypass issues in downstream dependencies.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-61891 — Official CVE record with CVSS vector and description.
2. Eclipse Theia GitHub Security Advisory: https://github.com/eclipse-theia/theia/security/advisories — Vendor advisory page; check for GHSA reference matching CVE-2026-61891.
3. Eclipse Theia Release Notes (1.73.2): https://github.com/eclipse-theia/theia/releases — Verify the patch version and changelog entry.
4. CWE-22 Documentation: https://cwe.mitre.org/data/definitions/22.html — Path traversal weakness class reference.
5. Threat Actor Activity: No known campaigns or exploit-in-the-wild evidence as of writing. EPSS score of 0.00457 (37.4th percentile) indicates low immediate exploitation likelihood; however, the lack of known exploits combined with a High CVSS score makes this a prime target for automated scanning once the patch diff is published. Monitor Shodan for exposed Theia instances using the dorks below to gauge real-world exposure.

Shodan Search Dorks for Exposure Assessment:

• http.title:"Theia"
• http.component:"Theia"
• http.favicon.hash:"theia" port:3000