CVE-2026-82958

Eclipse Ditto's connectivity service contains a JSON injection flaw (CWE-74/CWE-116/CWE-1336) in its ImplicitThingCreationMessageMapper, which builds a CreateThing command by splicing inbound message-header values into a pre-configured JSON 'thing' template as raw, un-escaped strings before parsing. An attacker who can publish on a connection using this (non-default) mapper can supply a header value containing a double quote, breaking out of the JSON string and injecting an inline _policy object into the newly created digital twin. The injected policy overrides the administrator-configured policyId, giving the attacker full read/write access to the new twin and potentially revoking the legitimate owner's access, with no administrator interaction. Affected deployments are those where the ImplicitThingCreation mapper is configured, its template reflects an attacker-controllable header (such as an MQTT 5 user property, AMQP 1.0 application property, or Kafka record header), and the connection's authorization subjects are permitted to create policies (the default; deployments restricting subjects to thing creation only are not affected by the policy-override impact). There is no known public proof-of-concept, no CISA KEV listing, and EPSS is 0.2%, indicating no known exploitation at this time.

What to do: Upgrade Eclipse Ditto to 3.9.6 or later (the top of the published affected range). Until upgraded, audit connectivity configurations for use of the ImplicitThingCreation mapper and templates that reflect attacker-controllable headers, and restrict affected connections' authorization subjects to thing creation only (blocking policy creation) to eliminate the policy-override impact. Review recently created digital twins for unexpected inline _policy objects that override the administrator-configured policyId.