CVE-2026-107597
MediumCVSS 5.1Summary
PIA's token verification (verify_token in pia/oidc.py) fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks_uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS. An approved identity provider can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext http, from PIA's own network position, before any signature is verified.
Risk Assessment
A malicious or compromised identity provider can abuse PIA to scan and send requests to internal network resources, potentially leading to information disclosure or SSRF attacks.
Recommendation
Upgrade PIA to a version that validates jwks_uri as a URL, compares it against the approved issuer's origin, and requires HTTPS. Until then, limit trust in identity providers and monitor for unusual outbound requests.
Other vulnerabilities in PIA
See all- CVE-2026-18353High
PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its unverified `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash into different hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` to connect to an arbitrary attacker-chosen host.
- CVE-2026-14336High
The vulnerability in PIA uses a bare string-prefix check for the OIDC issuer allowlist instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer that passes the prefix check but points to a controlled server. This allows an unauthenticated caller of POST /v1/upload/sbom to force outbound HTTP(S) requests to an arbitrary host and accept a JWT signed with the attacker's key.
- CVE-2026-12616Medium
The vulnerability in the /v1/upload/sbom endpoint allows an unauthenticated attacker to inject fake log entries by manipulating the iss claim in a JWT token. Due to disabled JWT signature verification and literal newline rendering in the log format, the attacker can create entries indistinguishable from genuine successful authentication messages.
Original NVD description (English source)
PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (`pia/oidc.py:42-52`). An approved identity provider — and every registered per-project Jenkins instance under `https://ci.eclipse.org/<project>/oidc` is a separate such party (`pia/models.py`) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext `http`, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated `POST /v1/upload/sbom` request that is ultimately rejected with 401.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS