Eclipse Connected Services Platform vulnerabilities

2 known vulnerabilities in Eclipse Connected Services Platform from Eclipse Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Eclipse Connected Services Platform: Improper Privilege Management

  CVE-2026-110724Oct 15, 2026Eclipse Foundation

  In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and

• 7.5 High severity

  Eclipse Connected Services Platform: Authentication Bypass by Spoofing

  CVE-2026-110723Oct 15, 2026Eclipse Foundation

  In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and