CVE-2026-16454: Object-Level Authorization Bypass in Eclipse hawkBit Direct Device Integration Controller

Vulnerability ID: CVE-2026-16454
CVSS Score: 4.3
Published: 2026-11-06

CVE-2026-16454 is an object-level authorization bypass vulnerability (CWE-284, CWE-862) in Eclipse hawkBit versions 1.0.3 and prior. The flaw exists within the Direct Device Integration (DDI) REST controller (hawkbit-ddi-resource), where endpoints responsible for enumerating software module metadata and serving firmware binaries fail to verify whether the requested software module is assigned to the authenticated device. Consequently, any device with valid credentials (such as a TargetToken or GatewayToken) can enumerate software module identifiers and download arbitrary firmware artifacts across the entire tenant namespace.

TL;DR

An object-level authorization bypass in Eclipse hawkBit's DDI controller (<= 1.0.3) allows any authenticated IoT device to enumerate and download arbitrary firmware artifacts belonging to other devices within the same tenant. Upgrade to version 1.0.4 to enforce strict device-to-artifact assignment validation.

Technical Details

CVE ID: CVE-2026-16454 (GHSA-92r3-p8c2-3fpx)
Weakness Class: CWE-862 (Missing Authorization) / CWE-284 (Improper Access Control)
Affected Component: DdiRootController (hawkbit-ddi-resource <= 1.0.3)
Attack Vector: Network (Authenticated DDI HTTP REST API)
CVSS v3.1 Score: 4.3 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
EPSS Score: 0.36% (29.53rd Percentile)
Primary Impact: Unauthorized enumeration and download of tenant firmware artifacts
Patched Version: Eclipse hawkBit 1.0.4

Affected Systems

Eclipse hawkBit Update Server
org.eclipse.hawkbit:hawkbit-ddi-resource
org.eclipse.hawkbit:hawkbit-ddi-server
Eclipse hawkBit: <= 1.0.3 (Fixed in: 1.0.4)

Code Analysis

Commit: 6cb34fd

Enforce action assignment check on artifact and MD5 download endpoints regardless of HTTP Range header

File: hawkbit-ddi/hawkbit-ddi-resource/src/main/java/org/eclipse/hawkbit/ddi/rest/resource/DdiRootController.java @@ -170,12 +170,14 @@ - final ActionStatus actionStatus = RequestResponseContextHolder.getHttpServletRequest().getHeader("Range") == null - ? logDownload(RequestResponseContextHolder.getHttpServletRequest(), target, module.getId()) - : null; // range request - could have too many - so doesn't check action, don't log action status, and don't publish events + // check action assigned to device + final Action action = Objects.requireNonNull( + controllerManagement.getActionForDownloadByTargetAndSoftwareModule(target.getControllerId(), module.getId())); + final ActionStatus actionStatus = getHttpServletRequest().getHeader("Range") == null + ? logDownload(action) + : null; // range request - could have too many - so doesn't check action, don't log action status, and don't publish events @@ -216,6 +218,8 @@ - logDownload(RequestResponseContextHolder.getHttpServletRequest(), target, module.getId()); - writeMD5FileResponse(RequestResponseContextHolder.getHttpServletResponse(), artifact.getMd5Hash(), fileName); + // check action assigned to device + final Action action = Objects.requireNonNull( + controllerManagement.getActionForDownloadByTargetAndSoftwareModule(target.getControllerId(), module.getId())); + logDownload(action); + writeMD5FileResponse(getHttpServletResponse(), artifact.getMd5Hash(), fileName);

Commit: 914b8b4

Enforce active or installed action assignment verification in getSoftwareModulesArtifacts metadata endpoint

File: hawkbit-ddi/hawkbit-ddi-resource/src/main/java/org/eclipse/hawkbit/ddi/rest/resource/DdiRootController.java @@ -125,12 +126,29 @@ public class DdiRootController implements DdiRootControllerRestApi { @Override public ResponseEntity<List<DdiArtifact>> getSoftwareModulesArtifacts( - final String tenant, final String controllerId, final Long softwareModuleId) { - log.debug("getSoftwareModulesArtifacts({})", controllerId); - final Target target = findTarget(controllerId); - final SoftwareModule softwareModule = controllerManagement.getSoftwareModule(softwareModuleId); - return new ResponseEntity<>( - DataConversionHelper.createArtifacts( - target, softwareModule, artifactUrlHandler, systemManagement, - new ServletServerHttpRequest(RequestResponseContextHolder.getHttpServletRequest())), - HttpStatus.OK); + final String tenant, final String controllerId, final Long softwareModuleId) { + final Target target = findTargetOrThrow(controllerId); + final SoftwareModule softwareModule = controllerManagement.getSoftwareModule(softwareModuleId); + + // check action assigned to device + try { + final Action action = Objects.requireNonNull( + controllerManagement.getActionForDownloadByTargetAndSoftwareModule(controllerId, softwareModuleId)); + log.debug("getSoftwareModulesArtifacts({}, {}) for action {}", controllerId, softwareModuleId, action.getId()); + } catch (final SoftwareModuleNotAssignedToTargetException e) { + controllerManagement.findInstalledActionByTarget(target) + .filter(action -> action.getDistributionSet().getModules().stream() + .map(SoftwareModule::getId).anyMatch(id -> id.equals(softwareModuleId))) + .ifPresentOrElse( + action -> log.debug("getSoftwareModulesArtifacts({}, {}) for installed action {}",  controllerId, softwareModuleId, action.getId()), + () -> { + throw e; + }); + } + + return new ResponseEntity<>( + createArtifacts( + target, softwareModule, artifactUrlHandler, systemManagement, new ServletServerHttpRequest(getHttpServletRequest())), + HttpStatus.OK);  }

Mitigation Strategies

Upgrade Eclipse hawkBit instances and embedded hawkbit-ddi-resource libraries to version 1.0.4 or later.
Segregate device fleets with differing security postures or physical exposure profiles into separate hawkBit tenants.
Enforce rate limiting on DDI softwaremodule endpoints via an upstream API gateway or reverse proxy to prevent sequential ID enumeration.
Replace shared GatewayToken authentication with individual per-device TargetTokens or mutual TLS (mTLS) certificates.

Remediation Steps:

Identify all deployments running Eclipse hawkBit monoliths or microservices utilizing hawkbit-ddi-resource versions 1.0.3 and earlier.
Update Maven/Gradle build configurations or Docker deployment manifests to reference Eclipse hawkBit version 1.0.4.
Deploy the updated build and verify that unauthenticated or unassigned softwareModuleId requests return HTTP 404/403 via SoftwareModuleNotAssignedToTargetException.
Audit HTTP access logs for historical sequential requests to /{tenant}/controller/v1/{controllerId}/softwaremodules/{id}/artifacts to determine if enumeration occurred prior to patching.