CVE-2026-10054: Eclipse Theia Unauthenticated Terminal RPC Vulnerability

Technical summary

The vulnerability exists in Theia's browser backend terminal RPC exposure via WebSocket at /services/shell-terminal and /services/terminals/:id endpoints. The @theia/core module implements origin validation for WebSocket connections, but the check is fail-open: it accepts connections when the Origin header is absent or when no THEIA_HOSTS allowlist is configured (the default deployment state). Further, Socket.IO integration in the stack replaces the authentic Origin header with a fix-origin header supplied by the client, which an attacker controls. An unauthenticated, same-process-privileged WebSocket connection can invoke terminal creation RPCs, receive terminal output, and execute OS commands. The flaw is classified as missing origin validation (CWE-1385) and improper authentication (CWE-306).

Business impact

This vulnerability poses a direct threat to both individual developer workstations and shared or hosted Theia deployments. A drive-by attack via a malicious website can compromise the integrity and confidentiality of any system with an active Theia instance. An attacker gains arbitrary code execution in the context of the user running Theia, potentially enabling data exfiltration, malware installation, lateral movement within a network, or sabotage. For organizations deploying Theia in cloud or tunneled environments (e.g., for remote development), the risk is amplified if external authentication is weak. The absence of default authentication also means security misconfigurations are common, expanding the attack surface significantly.

Affected systems

Eclipse Theia versions 1.8.1 and later are affected. This includes the current stable release line and all subsequent versions until a patched release is published. The vulnerability impacts all deployment modes: local developer machines, remote Theia instances, and containerized or cloud-hosted setups. Any user or service with network access to the Theia browser backend (typically port 3000 by default) is at risk if they visit a malicious or compromised website during an active Theia session.

Exploitability

Exploitability is high. The attack requires no special privileges, no complex network positioning, and minimal technical sophistication. An attacker needs only to (1) host a malicious web page, (2) trick a user running Theia into visiting it, and (3) issue WebSocket requests to the known terminal endpoints. No authentication is required, and origin validation is either absent or bypassable via the client-controlled fix-origin header. The attack succeeds in the default configuration without any additional tuning. User interaction is minimal (visiting a website), making this a practical and scalable threat.

Remediation

Await and deploy the patched version of Eclipse Theia once released. The upstream fix enforces same-origin validation by default, removes reliance on the client-supplied fix-origin header, gates HTTP and WebSocket access behind a SameSite=Strict; HttpOnly connection-token cookie, and sanitizes shell terminal creation options. Until a patch is available, mitigations include: (1) configuring a THEIA_HOSTS allowlist to explicitly permit only expected origin domains, (2) running Theia only in trusted network environments with external authentication (e.g., reverse proxy with OAuth), (3) disabling remote access to Theia if not required, and (4) running Theia in a restricted container or VM to limit the blast radius of command execution.

Patch guidance

Monitor Eclipse Theia's official GitHub repository and release channels for a patched version. When available, apply the patch immediately to all affected instances. Before upgrading, verify that the patch version documentation confirms the fix addresses CVE-2026-10054, including the origin validation, fix-origin header removal, and connection-token cookie implementation. Test the patched version in a staging environment to ensure compatibility with your deployment. If you run Theia in a container, rebuild your image with the patched version and redeploy. For users unable to patch immediately, implement the network and configuration mitigations listed in the remediation summary.

Detection guidance

Monitor WebSocket traffic to Theia for suspicious patterns: (1) WebSocket connections to /services/shell-terminal or /services/terminals/:id from external or unexpected origins, (2) requests with missing Origin headers or suspicious fix-origin header values, (3) rapid terminal creation and command execution sequences, especially from non-developer sources. Log and alert on any terminal creation RPC calls that originate from outside your expected network or authentication context. Implement network intrusion detection rules to flag cross-origin WebSocket requests to Theia's terminal endpoints. If you have access to Theia logs, look for unexpected RPC invocations or shell command execution tied to unauthenticated sessions.

Why prioritize this

This vulnerability merits immediate priority due to the combination of high CVSS score (8.8), trivial exploitability, and severe impact (arbitrary code execution). The default-unsafe configuration means most Theia deployments are vulnerable without explicit remediation steps. The requirement for user interaction is minimal (visiting a website), and the attack is reliable and scalable. Organizations should treat this as a critical security incident and prioritize patching or mitigation across all Theia instances.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) network-accessible attack vector with no special privileges required (AV:N, PR:N), (2) low attack complexity due to straightforward WebSocket exploitation (AC:L), (3) user interaction needed but minimal (UI:R—visiting a malicious site), (4) high confidentiality, integrity, and availability impact via arbitrary OS command execution (C:H, I:H, A:H). The score does not account for the wide deployment of Theia in development workflows or the default-unsafe configuration, which elevate practical risk beyond the numerical score.

Frequently asked questions