CVE-2026-10055: Eclipse Theia SSRF Vulnerability in /services/request-service

Technical summary

The vulnerability resides in the `/services/request-service` RPC handler, which accepts user-supplied URLs and executes HTTP requests server-side without validation or allowlisting. The full response body is returned to the caller. An authenticated client connected to the `/services` messaging endpoint can supply arbitrary URLs—including localhost addresses, internal IP ranges, or cloud metadata service endpoints—and receive their responses. The lack of URL validation means internal services, administrative endpoints, and credential-bearing metadata services become accessible to any user with Theia connection access. This is a classic SSRF pattern (CWE-918) compounded by information disclosure (CWE-200).

Business impact

In multi-tenant environments, a single malicious user can probe and exfiltrate data from other tenants' backend systems or shared infrastructure. Public-facing Theia instances become a beachhead for reconnaissance and lateral movement into internal networks. Attackers can harvest cloud instance metadata (AWS, GCP, Azure credentials), extract configuration data, or trigger unintended actions on internal services. The combination of network-boundary bypass and information disclosure elevates risk significantly in cloud-native and hosted IDE scenarios.

Affected systems

Eclipse Theia versions 1.26.0 through the time of publication are affected. The vulnerability requires an attacker to have network access to the Theia service's `/services` messaging endpoint. Deployments where this endpoint is restricted to trusted networks or internal use only face lower risk. Public cloud IDE platforms, self-hosted Theia instances exposed to the internet, and multi-tenant SaaS offerings using Theia are at highest risk.

Exploitability

Exploitability is straightforward once an attacker has access to the Theia service connection. No authentication bypass is required—only the ability to send a crafted RPC message to `/services/request-service`. The attacker controls the target URL and receives the full response. Attack complexity is low, and the attacker needs only a single authenticated or semi-trusted connection. In public deployments, an attacker may register a free account or use a guest connection to trigger exploitation.

Remediation

Apply patches from Eclipse Theia that add URL validation and allowlisting to the `/services/request-service` endpoint. Validate that target URLs are restricted to approved domains or internal ranges, or disable the endpoint entirely if not required. As an interim mitigation, restrict network access to the Theia `/services` endpoint to trusted internal networks only, and disable public access. Review IAM and network policies to ensure Theia backend processes cannot reach sensitive internal services or metadata endpoints.

Patch guidance

Monitor Eclipse Theia release notes and security advisories for patches addressing this SSRF vulnerability. Verify vendor guidance for the specific patched version numbers and apply updates to all Theia installations as soon as available. Test patches in a non-production environment first. If you run a managed Theia service or IDE platform, contact your vendor immediately for patching timelines and workarounds.

Detection guidance

Monitor Theia logs and network traffic for suspicious `/services/request-service` RPC calls, particularly those targeting localhost (127.0.0.1), private IP ranges (10.x.x.x, 172.16–31.x.x, 192.168.x.x), or cloud metadata endpoints (169.254.169.254). Look for HTTP requests from the Theia backend process to unexpected destinations. Set up alerts for repeated failed requests or successful connections to sensitive internal services. Network segmentation monitoring and egress filtering can help detect and block outbound requests from the Theia service to internal resources.

Why prioritize this

This vulnerability merits high priority due to its high CVSS score (8.5), low attack complexity, and broad impact in cloud and multi-tenant scenarios. It enables network-boundary bypass and unauthorized information disclosure with minimal attacker effort. Organizations running Theia in any shared or publicly-accessible mode should treat this as critical. Even in internal-only deployments, the risk of lateral movement and credential theft justifies rapid patching.

Risk score, explained

CVSS 8.5 (HIGH) reflects the combination of network-accessible attack vector, low attack complexity, required but easy-to-obtain authentication (user connection to the service), significant confidentiality impact (internal resource disclosure), and limited but present integrity impact (potential to trigger unintended backend actions). The scope is changed, elevating risk. The vulnerability does not grant direct code execution or persistent access, preventing a critical rating, but the breadth of information exposure and network-boundary bypass justify the high score.

Frequently asked questions