# org.eclipse.basyx:basyx.sdk (Maven) vulnerabilities

2 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 1.5.1 (Feb 5, 2024): affected by 2 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Dependents: 10
- Releases: 9 since 1.0.1 (Oct 21, 2021)
- Registry: https://central.sonatype.com/artifact/org.eclipse.basyx/basyx.sdk
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-7412: 1.0.1 to 1.5.1 (through the newest release)
- CVE-2026-7411: 1.0.1 to 1.5.1 (through the newest release)

## Advisories (2)

### [CVE-2026-7412](https://cve.now/CVE-2026-7412): In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination…

- Severity: High 8.6
- Published: May 5, 2026
- Affected: fixed in 2.0.0-milestone-10.
- No fix released. The advisory names 2.0.0-milestone-10 as the fix, which the registry doesn't have yet. The latest release, 1.5.1, is still affected.

### [CVE-2026-7411](https://cve.now/CVE-2026-7411): In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an…

- Severity: Critical 10.0
- Published: May 5, 2026
- Affected: fixed in 2.0.0-milestone-10.
- No fix released. The advisory names 2.0.0-milestone-10 as the fix, which the registry doesn't have yet. The latest release, 1.5.1, is still affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.eclipse.basyx:basyx.sdk
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.