Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration

Description A privilege escalation vulnerability has been identified in the Direct Device Integration DDI Controller of Eclipse hawkBit versions 1.0.3 and prior. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates...

org.eclipse.hawkbit:hawkbit-boot-starter (>=0.5.0, <=0.6.1), org.eclipse.hawkbit:hawkbit-boot-starter-ddi-api (>=0.2.0, <=0.6.1) +5 more potentially affected by CVE-2026-16454 via org.eclipse.hawkbit:hawkbit-ddi-resource (>=0.2.0, <=1.0.3)

org.eclipse.hawkbit:hawkbit-ddi-resource MAVEN version =0.2.0, =0.5.0, =0.2.0, =0.4.0, =0.7.0, =0.7.0, =0.5.0, =0.5.0, =1.0.3 Source cves: CVE-2026-16454 Source advisory: MEND:CVE-2026-16454...