Live › vulnerability › CVE-2026-107597
Go to dashboardPIA's token verification follows a jwks_uri from an approved OIDC issuer's discovery document without checking it is a URL on that issuer or uses HTTPS. An approved identity provider, including any per-project Jenkins OIDC instance, can make PIA send GET requests to arbitrary hosts and ports from its own network position, before any signature check.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of PIA that accept tokens from multiple OIDC issuers, including the per-project Jenkins instances under ci.eclipse.org, are exposed because any one of those parties can steer PIA's outbound requests. Deployments that trust only a single issuer that the operator fully controls have less reason to worry. The sources do not say which PIA versions are affected.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PIA's token verification (verify_token in pia/oidc.py) fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks_uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (pia/oidc.py:42-52). An approved identity provider — and every registered per-project Jenkins instance under https://ci.eclipse.org/<project>/oidc is a separate such party (pia/models.py) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext http, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated POST /v1/upload/sbom request that is ultimately rejected with 401.
This page as .md · .json · in your agent: get_signal("CVE-2026-107597")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.