The vulnerability lies in the BaSyx Operation Delegation feature, which does not validate the destination URI of delegated requests. An unauthenticated remote attacker can send specially crafted requests that cause the BaSyx server to issue blind HTTP POST requests to arbitrary internal or external URLs. This design flaw enables an attacker to bypass network segmentation, pivot into isolated internal or OT environments, or target cloud metadata services such as IMDS. The impact is a forced outbound transaction that can be leveraged for data exfiltration, lateral movement, or further compromise.

All instances of the Eclipse BaSyx Java Server SDK with versions older than 2.0.0‑milestone‑10 are affected. No specific build numbers beyond the milestone are listed, so all releases prior to this milestone should be considered vulnerable.

The CVSS score of 8.6 indicates a high severity vulnerability that is remotely exploitable without authentication. Although the EPSS score is not available, the high CVSS rating and the direct ability to issue arbitrary POST requests suggest a significant risk of exploitation. The vulnerability is not yet listed in the CISA KEV catalog, but the attack vector—remote manipulation of outbound traffic via the Operation Delegation endpoint—is likely to be usable over a network connection to the BaSyx server.