Eclipse CSI - PIA vulnerabilities

2 known vulnerabilities in Eclipse CSI - PIA from Eclipse Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Eclipse CSI - PIA: Server-Side Request Forgery

  CVE-2026-18353Jul 30, 2026Eclipse Foundation

  PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an au

• 8.2 High severity

  Eclipse CSI - PIA: Server-Side Request Forgery

  CVE-2026-14336Jul 2, 2026Eclipse Foundation

  PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issue