Eclipse Theia Terminal RPC Exposed Without Authentication

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The Socket.IO integration additionally replaces the real Origin header with a client-supplied fix-origin header that an attacker can control or omit. As a result, a foreign-origin web page visited by a user with a running Theia instance can open the /services WebSocket namespace, invoke terminal creation, attach to the resulting terminal data channel, execute arbitrary OS commands, and read their output. This affects both local developer setups (drive-by attack) and hosted or tunneled deployments without strong external authentication. A fix is in development that enforces same-origin vali

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Eclipse Theia versions 1.8.1 and later contain a critical authentication bypass vulnerability in their browser backend, where privileged terminal RPC endpoints (/services/shell-terminal, /services/terminals/:id) are exposed over WebSocket without service-level authentication. The vulnerability is compounded by fail-open WebSocket origin validation that accepts connections when the Origin header is missing or when no THEIA_HOSTS allowlist is configured—a permissive default that affects most deployments. This flaw enables unauthenticated attackers to gain remote code execution capabilities by directly invoking terminal operations, making it particularly dangerous for organizations running Theia-based development environments, cloud IDEs, or collaborative coding platforms that may be exposed to network-accessible endpoints.

Casky.ai's 283 mapped security skills enable detection of the exploitation patterns underlying this vulnerability by analyzing activity against MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns including: unauthenticated WebSocket connections to /services/shell-terminal endpoints lacking proper Origin validation, unexpected terminal RPC invocations from clients without valid authentication tokens, and shell command execution chains initiated through privileged terminal services. The platform's Claude-powered analysis correlates these indicators—particularly abnormal cross-origin WebSocket traffic, missing or malformed Origin headers, and unauthorized terminal spawning—against the 754 mapped security skills to surface attack chains that exploit this fail-open authentication model, alerting teams to potential lateral movement or code execution attempts targeting their Theia infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-10054.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-10054

Casky has 283 skills that investigate the attack patterns behind CVE-2026-10054. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn