Eclipse Csi - Pia (Eclipse Foundation) - vulnerabilities (CVEs)

5 CVEs, 2 in the last 30 days, 1 known versions, newest CVE from 2026-10-20. Vendor: Eclipse Foundation.

CVEs of Eclipse Csi - Pia

• CVE-2026-107597 - CVSS 5.1 (medium), 2026-10-20: PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri`…
• CVE-2026-108062 - CVSS 6.9 (medium), 2026-10-20: Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
• CVE-2026-18353 - CVSS 8.8 (high), 2026-07-30: PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse`…
• CVE-2026-14336 - CVSS 8.2 (high), 2026-07-02: PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known,…
• CVE-2026-12616 - CVSS 6.9 (medium), 2026-06-29: The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into…