In Eclipse Ditto versions 3.0.0 to 3.9.6 the Things service fetches Web of Things ThingModels from URLs supplied by users in the Thing or Feature definition field. The service does not validate the target host, follows HTTP redirects without re‑validating the new target or applying a hop limit, and issues the requests from inside the deployment's network. An authenticated user who can create a Thing or has WRITE permission on an existing Thing can cause the service to make arbitrary HTTP GET requests, including to cloud instance‑metadata endpoints and internal services, and can infer the presence of those services from differing error responses returned to the caller.

Vendor Eclipse Ditto, product Eclipse Ditto. Affected versions are 3.0.0 through 3.9.6. Versions 2.4.0 to 2.5.x are also vulnerable only when the WoT integration feature toggle is explicitly enabled; it is disabled by default in those older releases.

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have permission to create or update Things, but once that permission exists they can direct the instance to reach internal resources and enumerate services. The lack of host validation and redirect protection provides a viable server‑side request forgery attack vector.