CVE-2026-10054
Eclipse Theia: Insecure WebSocket Terminal Access
Description
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The Socket.IO integration additionally replaces the real Origin header with a client-supplied fix-origin header that an attacker can control or omit. As a result, a foreign-origin web page visited by a user with a running Theia instance can open the /services WebSocket namespace, invoke terminal creation, attach to the resulting terminal data channel, execute arbitrary OS commands, and read their output. This affects both local developer setups (drive-by attack) and hosted or tunneled deployments without strong external authentication. A fix is in development that enforces same-origin validation by default, removes trust in the fix-origin header, gates HTTP and WebSocket access on a SameSite=Strict; HttpOnly connection-token cookie, and sanitizes shell terminal creation options.
INFO
Published Date :
July 3, 2026, 11:16 a.m.
Last Modified :
Oct. 25, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | e51fbebd-6053-4e49-959f-1b94eeb69a2c | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update to a patched version when available.
- Enforce same-origin validation by default.
- Implement a SameSite=Strict; HttpOnly cookie.
- Sanitize shell terminal creation options.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-10054.
| URL | Resource |
|---|---|
| https://github.com/eclipse-theia/theia/security/advisories/GHSA-78g8-vm3p-97c6 | |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/376 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-10054 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-10054
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-10054 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-10054 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: Eclipse Theia de Eclipse Foundation, Description: En las versiones afectadas de Eclipse Theia (1.8.1 y posteriores), el backend del navegador expone RPC de terminal privilegiado a través de WebSocket (/services/shell-terminal, /services/terminals/:id) sin autenticación a nivel de servicio. La validación de origen de WebSocket en @theia/core es de tipo ’fail-open’: se aceptan conexiones cuando falta el encabezado Origin o cuando no hay una lista blanca THEIA_HOSTS configurada (el valor predeterminado). La integración de Socket.IO además reemplaza el encabezado Origin real con un encabezado ’fix-origin’ proporcionado por el cliente que un atacante puede controlar u omitir. Como resultado, una página web de origen externo visitada por un usuario con una instancia de Theia en ejecución puede abrir el espacio de nombres WebSocket /services, invocar la creación de terminales, adjuntarse al canal de datos del terminal resultante, ejecutar comandos arbitrarios del sistema operativo y leer su salida. Esto afecta tanto a las configuraciones de desarrollador locales (ataque de paso) como a las implementaciones alojadas o tunelizadas sin una autenticación externa fuerte. Se está desarrollando una solución que aplica la validación de mismo origen por defecto, elimina la confianza en el encabezado ’fix-origin’, restringe el acceso HTTP y WebSocket mediante una cookie de token de conexión SameSite=Strict; HttpOnly, y sanea las opciones de creación de terminales de shell. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 07, 2026
Action Type Old Value New Value Changed SSVC {'id': 'CVE-2026-10054', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-06T14:18:28.199629Z'} {'id': 'CVE-2026-10054', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-06T00:00:00+00:00'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 06, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-10054', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-06T14:18:28.199629Z'} -
New CVE Received by [email protected]
Jul. 03, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Eclipse Foundation', 'product': 'Eclipse Theia', 'versions': [{'status': 'affected', 'version': '1.8.1', 'lessThan': '1.73.0', 'versionType': 'semver'}], 'defaultStatus': 'unaffected'}] Added Description In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The Socket.IO integration additionally replaces the real Origin header with a client-supplied fix-origin header that an attacker can control or omit. As a result, a foreign-origin web page visited by a user with a running Theia instance can open the /services WebSocket namespace, invoke terminal creation, attach to the resulting terminal data channel, execute arbitrary OS commands, and read their output. This affects both local developer setups (drive-by attack) and hosted or tunneled deployments without strong external authentication. A fix is in development that enforces same-origin validation by default, removes trust in the fix-origin header, gates HTTP and WebSocket access on a SameSite=Strict; HttpOnly connection-token cookie, and sanitizes shell terminal creation options. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-306 Added CWE CWE-1385 Added Reference https://github.com/eclipse-theia/theia/security/advisories/GHSA-78g8-vm3p-97c6 Added Reference https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/376