Eclipse Arrowhead vulnerabilities

2 known vulnerabilities in Eclipse Arrowhead from Eclipse Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.5 Critical severity

  Eclipse Arrowhead: Authentication Bypass by Spoofing

  CVE-2026-82180Sep 3, 2026Eclipse Foundation

  In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload (the authentication field of Mqtt

• 8.9 High severity

  Eclipse Arrowhead: Use of Non-Canonical URL Paths for Authorization Decisions

  CVE-2026-80515Sep 3, 2026Eclipse Foundation

  In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat returns getRequestURL()