dbcve.org
Missing AuthenticationWeakness · CWE-306

CVE-2026-10054

HIGH · 8.8 CVSS v3.1 Published 2026-07-03
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
95/100
Remediation priority · Urgent
Remotely reachable No privileges 7 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The Socket.IO integration additionally replaces the real Origin header with a client-supplied fix-origin header that an attacker can control or omit. As a result, a foreign-origin web page visited by a user with a running Theia instance can open the /services WebSocket namespace, invoke terminal creation, attach to the resulting terminal data channel, execute arbitrary OS commands, and read their output. This affects both local developer setups (drive-by attack) and hosted or tunneled deployments without strong external authentication. A fix is in development that enforces same-origin validation by default, removes trust in the fix-origin header, gates HTTP and WebSocket access on a SameSite=Strict; HttpOnly connection-token cookie, and sanitizes shell terminal creation options.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Eclipse Theia 1.8.1+ exposes privileged terminal RPC over WebSocket endpoints without service-level authentication. The origin validation in @theia/core is fail-open, accepting connections when Origin header is missing or no THEIA_HOSTS allowlist exists. Additionally, the Socket.IO integration trusts a client-supplied fix-origin header, allowing attackers to bypass origin checks entirely and execute arbitrary OS commands through terminal sessions.

MitigationUntil the official fix is available, disable terminal services or implement external authentication/Proxy authentication to restrict access to the WebSocket endpoints. Avoid hosting Theia on public networks without strong external auth.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed Eclipse Theia version
    Run 'npm list @theia/core' or check package.json in your Theia installation directory to find the installed version
    Affected if Version is 1.8.1 or higher
  2. Verify if terminal services are enabled
    Check your Theia application configuration or package.json for @theia/terminal package inclusion and ensure terminal extensions are loaded
    Affected if Terminal services are enabled and the Theia version is 1.8.1+
  3. Inspect THEIA_HOSTS configuration
    Check environment variables and application configuration files for THEIA_HOSTS setting; if absent or empty, origin validation is fail-open
    Affected if THEIA_HOSTS is not set or is empty, enabling fail-open origin validation
  4. Check WebSocket endpoint exposure
    Examine your server configuration for WebSocket endpoints handling terminal RPC (typically at /terminals path or Socket.IO terminal namespace)
    Affected if Terminal WebSocket endpoints are accessible without additional authentication layers
  5. Review Socket.IO fix-origin header handling
    Inspect your Socket.IO server configuration to determine if client-supplied fix-origin headers are being trusted without validation
    Affected if Socket.IO is configured to trust client-supplied origin headers without server-side verification

You are affected if running Eclipse Theia version 1.8.1 or higher with terminal services enabled and either THEIA_HOSTS is unset/empty or your Socket.IO configuration trusts client-supplied origin headers.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Until the official fix is available, disable terminal services or implement external authentication/Proxy authentication to restrict access to the WebSocket endpoints. Avoid hosting Theia on public networks without strong external auth.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation12.0 h
  • Testing6.0 h
  • Review / QA3.0 h
25.0 hours of engineering $4,400
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,040.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-10054 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-10054 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data