MEDIUM 4.3 GitHub
CVE-2026-16454
Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration
## **Description**
A privilege escalation vulnerability has been identified in the Direct Device Integration (DDI) Controller of **Eclipse hawkBit** (versions 1.0.3 and prior).
This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted **strictly to the specific firmware artifacts explicitly assigned to it**. However, this flaw enables any authenticated device to by
Affected Products
- maven/org.eclipse.hawkbit:hawkbit-ddi-resource <= 1.0.3
References
- https://github.com/advisories/GHSA-92r3-p8c2-3fpx
- https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx
- https://nvd.nist.gov/vuln/detail/CVE-2026-16454
- https://github.com/eclipse-hawkbit/hawkbit/pull/3156
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-11-06 via GitHub. Affected: maven/org.eclipse.hawkbit:hawkbit-ddi-resource <= 1.0.3.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.