Summary
Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration
Description
A privilege escalation vulnerability has been identified in the Direct Device Integration (DDI) Controller of Eclipse hawkBit (versions 1.0.3 and prior).
This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact within the same tenant.
This is not an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.
A related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.
Impact
- Severity: Moderate
- Scope: Tenant-isolated. An attacker must be an authenticated device within the target tenant to exploit this vulnerability.
- Confidentiality Impact: Low. While firmware binaries can be retrieved, the impact is mitigated because access is restricted strictly to the scope of the pre-authenticated tenant, and no administrative or cross-tenant data is exposed. Additionally, production firmware binaries are by design not expected to contain highly sensitive or confidential data (such as hardcoded credentials or private keys), further supporting the Low confidentiality rating.
Affected Products and Versions
- Product:
eclipse-hawkbit/hawkbit - Affected Component:
hawkbit-ddi/hawkbit-ddi-resource, as well as the compiled binaries and Docker images that contain this component. - Affected Versions:
1.0.3and prior versions. - Patched Version:
1.0.4
Remediation
Upgrade to version 1.0.4 or later.
Fix details: The download authorization logic has been corrected to ensure that assignment-based verification is executed on every artifact download request. Additionally, the software module metadata endpoint has been updated to enforce proper authorization, restricting access exclusively to software modules and artifacts that are explicitly assigned to or already installed on the requesting device.
Credits
Eclipse would like to thank Santosh Kumar Puppala (GitHub: Santoshkumarpuppala, Email: [email protected]) for discovering and reporting this vulnerability through coordinated disclosure.
Impact
The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.
CVE-2026-16454 has a CVSS score of 4.3 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.0.4); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-16454? CVE-2026-16454 is a medium-severity missing authorization vulnerability in org.eclipse.hawkbit:hawkbit-ddi-resource (maven), affecting versions <= 1.0.3. It is fixed in 1.0.4. The application does not perform an authorization check before performing a sensitive operation.
- How severe is CVE-2026-16454? CVE-2026-16454 has a CVSS score of 4.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of org.eclipse.hawkbit:hawkbit-ddi-resource are affected by CVE-2026-16454? org.eclipse.hawkbit:hawkbit-ddi-resource (maven) versions <= 1.0.3 is affected.
- Is there a fix for CVE-2026-16454? Yes. CVE-2026-16454 is fixed in 1.0.4. Upgrade to this version or later.
- Is CVE-2026-16454 exploitable, and should I be worried? Whether CVE-2026-16454 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-16454 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-16454? Upgrade
org.eclipse.hawkbit:hawkbit-ddi-resourceto 1.0.4 or later.