8.2
High
CVE-2026-14336 PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith('…
Description
PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix check while pointing the OIDC discovery and JWKS fetches at a server the attacker controls. An unauthenticated caller of POST /v1/upload/sbom can use this to force PIA to make outbound HTTP(S) requests to an arbitrary attacker-chosen host, and to have oidc.verify_token accept a JWT signed with the attacker's own key.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse CSI - PIA 0.3 | earliest → 0.3.0 | No fix stated |
Other CVEs of Eclipse CSI - PIA
The 5 CVEs of Eclipse CSI - PIA →
CVE-2026-107597
PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted…
5.1
Medium
CVE-2026-108062
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated…
6.9
Medium
CVE-2026-18353
PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer…
8.8
High
CVE-2026-12616
The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled,…
6.9
Medium