CVE-2026-84197: eclipse foundation eclipse ditto Improper Certificate Validation

Vulnerability summary

CVE-2026-84197 is a critical (CVSS 9.2) Improper Certificate Validation vulnerability in eclipse foundation eclipse ditto. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.4% of scored vulnerabilities.

Timeline

1. 08-09-2026
   PublishedVulnerability first disclosed.
2. 09-09-2026
   Last modifiedVulnerability information updated.

Description

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket. Certificate chain and hostname validation are therefore disabled for every wss:// connection, and no builder option, constructor argument or environment variable lets an application turn validation back on. An attacker in a position to intercept the connection can present an arbitrary certificate, complete the TLS handshake, read the credentials that the configured authentication provider sends in the Authorization header of the WebSocket upgrade request, and read, alter or inject Ditto Protocol messages for the lifetime of the connection. The Java client, the browser/DOM JavaScript client and the HTTP transport of the Node.js client are not affected.

• CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
• CWE-297Improper Validation of Certificate with Host MismatchThe product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
• CWE-300Channel Accessible by Non-EndpointThe product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.