Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-84197 is a critical-severity Improper Certificate Validation (CWE-295) vulnerability in Eclipse Ditto (inferred from references). Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-3 (Device Identification and Authentication) and SC-11 (Trusted Path) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-74162
Vulnerability Data
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket. Certificate chain and…
more
hostname validation are therefore disabled for every wss:// connection, and no builder option, constructor argument or environment variable lets an application turn validation back on. An attacker in a position to intercept the connection can present an arbitrary certificate, complete the TLS handshake, read the credentials that the configured authentication provider sends in the Authorization header of the WebSocket upgrade request, and read, alter or inject Ditto Protocol messages for the lifetime of the connection. The Java client, the browser/DOM JavaScript client and the HTTP transport of the Node.js client are not affected.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 17 hardening rules · 4 OS baselines
V17.2.8V12.3.5
Mitigating Controls (NIST 800-53 r5) AI
IA-3 mandates device identification and authentication prior to establishing communications, addressing the non-endpoint actor risk.
SC-23 enforces session authenticity protections that verify both endpoints and prevent channel manipulation by outsiders.
SC-11 provides an isolated trusted path that cryptographically or physically assures the identities of the two endpoints.
PKI certificate issuance and acquisition under an approved policy establishes the trusted roots and processes needed for correct validation.
Requiring confidentiality and integrity of transmitted data necessitates correct TLS certificate validation with host-name checking.
AC-17 requires documented usage restrictions and secure configuration for remote access channels, reducing exposure to non-endpoint actors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Assessing authenticity/integrity of acquired software often relies on code-signing certificate validation.
Certificate-based authentication of users/services/hardware directly depends on correct validation.
Identity assertions conveyed via certificates require validation to be verified.
Proper certificate validation is a core mechanism for protecting data-in-transit confidentiality and integrity.
Reduces unauthorized network access that could exploit an unprotected channel.
Secure development practices explicitly include implementing correct certificate validation logic.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information transfer policies address secure exchange but are high-level and not technical.
Network security controls include certificate validation and host-name verification to prevent man-in-the-middle attacks.
Security of network services requires proper TLS configuration and certificate validation for service endpoints.
Network segregation reduces exposure but does not verify endpoint identity or channel integrity.
Requiring issuance and validation of public-key certificates under an approved policy reduces the chance that certificates with improper validation will be trusted.
Application security requirements include secure communication and certificate validation for external services.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (6 rules)
- V-248574 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. prevents CWE-295, CWE-300
- V-248531 OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. prevents CWE-295
- V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-295
Oracle Linux 9 (1 rule)
- V-271462 OL 9 must not have a File Transfer Protocol (FTP) server package installed. prevents CWE-300
RHEL 7 (2 rules)
- V-204447 The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-295
- V-204448 The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-295
RHEL 8 (2 rules)
- V-230264 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-295
- V-230265 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-295