Skip to content
OpenAdvisories

Product · Eclipse Foundation

Eclipse CSI - PIA

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-18353

    Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

    PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an a…

    Eclipse Foundation Eclipse CSI - PIA
  • High 8.2
    CVE-2026-14336

    PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.…

    Eclipse Foundation Eclipse CSI - PIA