CVE-2026-82958

Executive Summary

CVE-2026-82958 is an injection vulnerability in Eclipse Ditto's ImplicitThingCreationMessageMapper, affecting versions 1.3.0 through 3.9.5. The flaw enables attackers to inject arbitrary JSON into a CreateThing command by exploiting a placeholder substitution mechanism that fails to escape special characters (notably double-quotes) in header-derived values. Successful exploitation allows an unauthenticated or low-privileged device to override the administrator-configured policy on newly created digital twins, assigning itself arbitrary read/write access and potentially revoking the legitimate owner's access. No patch or vendor advisory exists as of this writing; the vulnerability remains unpatched across all affected versions.

Technical Analysis

The vulnerability exists in the Eclipse Ditto connectivity service, specifically in the module responsible for mapping inbound messages to CreateThing commands used to provision digital twins. The affected component, ImplicitThingCreationMessageMapper, operates by:

1. Placeholder substitution: The mapper takes inbound message headers and substitutes placeholder tokens (e.g., {{ header:device_id }}) into a pre-configured JSON template representing a desired "thing" structure.
2. Raw string interpolation: Critically, placeholder resolution is performed as bare string substitution. The placeholder engine has no knowledge of JSON string context; it does not escape characters such as " (double quote) or \ (backslash) in resolved values.
3. JSON parsing: The resulting fully-substituted string is then parsed as JSON to construct a CreateThing protocol command sent to Ditto's things service.

The vulnerability emerges from the interaction between untrusted header data and the JSON template context. If a template reflects a placeholder inside a JSON string value (e.g., "namespace":"{{ header:device_id }}","id":"{{ header:device_id }}"), and the attacker controls the header value, they can craft a payload such as:

","_policy":{"policyId":"attacker-controlled-policy"}

When substituted, this escapes the enclosing string, terminates the string literal, injects a new JSON property before the original string closes, and introduces a valid _policy object. The injected policy overrides the policyId field that the administrator had configured in the template. Ditto's command-creation logic accepts the inline _policy object and applies its access-control rules for the newly created digital twin.

The attack surface is constrained by three prerequisites, all of which must be satisfied for successful exploitation:

1. The connection is configured to use the (non-default) ImplicitThingCreationMessageMapper.
2. The connection's message template reflects at least one placeholder sourced from a header that the publishing device can control (e.g., an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header).
3. The authorization subjects on the connection are, per Ditto's default, permitted to create policies — a requirement for the policy-override impact to be realized.

The affected placeholder values are resolved from message header metadata. In MQTT 5, user properties are arbitrary key-value pairs that can be set by the publisher without any pre-shared registry; similarly, AMQP 1.0 application properties and Kafka record headers carry user-defined metadata. This means the attack does not require a compromised broker or elevated messaging privileges — any entity able to publish on the connection queue/topic is a potential exploiter.

Insufficient technical detail is available to describe the mapper's internal function names, exact template variables, or request/response schemas beyond what is stated above.

Exploitation Scenarios

Reconnaissance/Identification: An attacker first must identify Eclipse Ditto endpoints that accept inbound messages (MQTT, AMQP 1.0, or Kafka). This may involve scanning for listening broker ports (typically 8883/1883 for MQTT, 5671/5672 for AMQP) and probing connection metadata to find a connection configuration that uses the ImplicitThingCreationMessageMapper. Banners or broker responses may expose the Ditto version.

Triggering: Once a promising connection is identified, the attacker publishes a message through the legitimate messaging protocol (e.g., MQTT PUBLISH with user properties, or an AMQP message with application properties). The connection must be configured to auto-create a thing on first message for the mapper to engage.

Payload Execution: The attacker crafts a header value that contains a JSON escape sequence and an inline policy object. At the vulnerability-class level, the payload exploits an injection flaw (CWE-74) where untrusted header data is executed as code (here, JSON structural data) without sanitization. A conceptual payload structure would be a username/device_id header value beginning with ", and containing a complete valid "_policy" block. No public PoC exists; the attack chain is inferred from the vulnerability class and description.

Post-Exploitation: Successful injection makes Ditto's service create a twin where the attacker-supplied inline policy supersedes the administrator's configured policy ID. The attacker gains full read/write access to the digital twin, and because they control the policy that governs it, they may remove all subjects that reference the intended owner. Resulting outcomes include: data exfiltration or tampering of the twin's state; denial of service to the legitimate device; and, in integrated systems, downstream effects where actuators or analytics subscribe to twin state.

Impact Assessment

CVSS Subscores: N/A — no CVSS vector or score has been published for this CVE. The absence of a score should not be read as low severity; the described impact (access-control override on provisioned resources without administrative interaction) typically maps to a high-severity injection issue.

Affected Systems: Any Eclipse Ditto deployment using the ImplicitThingCreation mapper and messaging templates that echo controllably set headers. These are commonly found in IoT and digital-twin environments where Ditto brokers state for devices and where automated provisioning is used.

Business Impact: If exploited, the confidentiality, integrity, and availability of device twin data are at risk. Because digital twins often mirror physical or logical assets, full read/write access can translate into unauthorized remote control of connected machinery or services, inaccurate state modeling leading to dangerous operational decisions, and data theft of device telemetry or configuration. Policy revocation can lock out legitimate device operators, creating an availability incident with significant recovery overhead.

Blast Radius: Each affected connection is independent. The impact is limited to twins created via the specific connection that uses the vulnerable mapper; existing twins and other connections remain unaffected. However, on connections that provision numerous twins (e.g., a factory floor ingesting each device's first report), a single malicious device can seize control of its own and possibly many co-provisioned twins.

Detection Guidance

Sigma Rule

title: Eclipse Ditto ImplicitThingCreation JSON Injection Attempt
id: 8a2f31d0-4a1c-4b2e-9f2a-112233445566
status: experimental
description: Detects inbound message header values containing JSON structural artifacts targeting Eclipse Ditto connectivity service.
logsource:
    category: application
    product: eclipse_ditto
detection:
    selection:
        event.action: message_received
        message.source: "connectivity"
    keywords:
        - '*"_policy"*'
        - '*\",\"*'
        - '*\\"*'
    condition: selection and keywords
level: high
falsepositives:
    - Legitimate device firmware that innocently includes embedded quotes in device IDs (rare)
    - Malformed but non-malicious messages

YARA Rule

rule Eclipse_Ditto_ImplicitInjection
{
    meta:
        author = "valtersit.com"
        description = "Detects JSON escape sequences indicative of placeholder injection into Ditto ImplicitThingCreation mapper"
        date = "2026-06-15"
        cve = "CVE-2026-82958"
        severity = "high"
    strings:
        $policy = "_policy"
        $policyid = "policyId"
        $escape1 = '\",\"'
        $escape2 = '\",'
        $control_header = "header:"
        $json_close = '\"}'
    condition:
        any of ($escape*) and any of ($policy*) and any of ($control_header*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"Eclipse Ditto — JSON injection attempt via message header (CVE-2026-82958)"; flow:established,to_server; content:"_policy"; pcre:"/\\\\\",?\s*\"_policy/i"; sid:30082958; rev:1; metadata: cve CVE-2026-82958, severity high;)

Note: This rule is protocol-agnostic and may generate noise; consider restricting to MQTT/AMQP/Kafka ports in production.

Elastic Detection

sequence by host.name, source.ip with maxspan=5s
  [ network where event.action == "connection_established" and destination.port in (1883, 8883, 5671, 5672) ]
  [ network where event.action == "data_transfer" and process.name == "java" and
     (message contains "_policy" or message matches ~".*\\\",\\\".*") ]

Splunk SPL Query

index=broker sourcetype=mqtt OR sourcetype=amqp OR sourcetype=kafka
| where match(_raw, "(?i)(_policy|\\\\\",\\\\\")")
| rename _raw as message
| stats count by host, src_ip, user, message
| sort -count

Wazuh OSSEC Rule

<rule id="857328" level="12">
    <decoded>message_received</decoded>
    <match>_policy|policyId</match>
    <regex>\\"</regex>
    <description>CVE-2026-82958: Possible JSON injection in Eclipse Ditto ImplicitThingCreation mapper via header</description>
    <group>eclipse_ditto_injection,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. Vendor fix and workaround details are N/A.

Immediate Mitigations:

1. This requires a change in the Eclipse Ditto connection configuration. Any in-production use of the ImplicitThingCreation mapper should be audited immediately. If the mapper is in use, do one of the following in order of preference:
   • Disable the mapper entirely, replacing it with a service-side provisioning endpoint that does not use message headers as template values.
   • If the mapper is required for business continuity, reconfigure all its connection templates so that no header-sourced placeholder is reflected into a JSON string. Only reflect values that are inherently controlled by the Ditto administrator (e.g., pre-authorized static identifiers).
2. Restrict which devices can publish to MQTT/AMQP/Kafka topics or queues that feed Ditto connections. Use broker-level ACLs to enforce least privilege — only devices that absolutely need to auto-provision twins should reach the mapper.
3. Consider architectural workaround: disable auto-provision at the edge; instead, create twins through a separate administrative workflow where the JSON template is fully static and only validated IDs are submitted.

Patch/Upgrade Steps: No patched version is released. Monitor the Eclipse Ditto project's security advisories, release notes, and Git repository for new tags post-3.9.5. When Ditto releases a version that includes placeholder-escaping logic or a fixed mapper, upgrade the connectivity service as soon as a test cycle passes. Do not assume that upgrading to the next minor release resolves this issue; verify release notes.

Long-Term Hardening:

1. Incorporate the fix for the placeholder engine to perform JSON-string-aware escaping (e.g., quoting " and \ and surrounding such values with proper JSON string encoding) rather than raw substitution.
2. Treat all message header metadata as untrusted input at the design level and sandbox per-connection policy creation capabilities. Remove system defaults where any device can create a policy if not strictly needed.
3. Enable audit logging on the connectivity service to track provisioning requests and policy modifications.
4. Ensure central separation between device code that publishes messages and the platform that provisions/owns twins; never grant device-gateway credentials that carry policy-management privileges.

References

1. NVD Entry for CVE-2026-82958 — https://nvd.nist.gov/vuln/detail/CVE-2026-82958
2. Eclipse Ditto Project — connectivity & message mapper documentation — https://eclipse.dev/ditto/
3. Eclipse Ditto Security Advisories Page — https://eclipse.dev/ditto/security.html
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

No known threat-actor campaigns or exploit-in-the-wild evidence is available for this CVE at the time of writing.