Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-101322

Vulnerability in Eclipse BaSyx AAS Web UI (CVE-2026-101322)

Summary

Vulnerability in Eclipse BaSyx AAS Web UI (CVE-2026-101322). Risk of unauthorized operations or information disclosure. Exploitable via Authorization. Mitigation: upgrade to 2-260924 or later.

Original description

The description as published by the source.

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose aas or path query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924.

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-101322 has been found in Eclipse BaSyx AAS Web UI.
Attackers can target a specific entry point like Authorization over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade Eclipse BaSyx AAS Web UI to 2-260924 or later.
If unsure, ask your IT team or search "Eclipse BaSyx AAS Web UI CVE-2026-101322" on the vendor's site.

CVE-2026-101322 (Eclipse BaSyx AAS Web UI) — CWE-201
Attack surface: Authorization / aas / path
Patched: 2-260924 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-201) exists in Eclipse BaSyx AAS Web UI. Attackers reach the vulnerable code path via Authorization.

📍 Affected scope

Check the vendor advisory for the affected versions of Eclipse BaSyx AAS Web UI. Attack surface: Authorization / aas / path.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 2-260924.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    Audit SBOM/dependencies for affected components.

    資産台帳・SBOM・依存マニフェストで Eclipse BaSyx AAS Web UI を使っているサービスとバージョンを洗い出す。

  2. 2
    Apply patch patch 
    Upgrade Eclipse BaSyx AAS Web UI to 2-260924

    ステージング環境で 2-260924 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details