CVE-2026-84175

Eclipse Ditto versions 3.0.0 through 3.9.6 (and 2.4.0–2.5.x when the WoT integration feature toggle is explicitly enabled) are affected by a Server-Side Request Forgery (SSRF) in the Things service. The service fetches WoT ThingModels over HTTP from URLs supplied by API users without validating t...