The Eclipse Theia backend exposes a /services/request-service RPC that accepts a URL supplied by any client connected to the /services messaging endpoint. The service then performs an HTTP request to that URL on the server side without validating or allowlisting the target, and returns the entire response body to the caller. This behavior implements a server‑side request forgery that can be used to read internal administrative interfaces, cloud metadata services, or other resources that are intentionally outside the browser network boundary. The vulnerability is classified as CWE‑200 (Information Exposure) and CWE‑918 (Server‑Side Request Forgery).

Eclipse Theia version 1.26.0 and later are affected, as the insecure URL handling code is present in all releases from 1.26.0 onward. The effect is limited to deployments where the /services endpoint is reachable by untrusted users, for instance in multi‑tenant or publicly exposed Theia instances. Hosted or self‑managed installations with restricted exposure to the /services endpoint are not susceptible.

Based on the description, it is inferred that an attacker only needs to send a request to the /services endpoint; no special credentials are required. The attack vector relies on the request-service RPC accepting URLs from any client connected to the /services messaging endpoint, so the risk is greatest when the service is exposed to untrusted users. The CVSS score of 8.5 indicates high severity, while the EPSS score of <1% suggests low probability of automated exploitation. The vulnerability is not listed in CISA’s KEV catalog.