Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-113422: Eclipse Kura lets unauthorized component changes

CVE-2026-113422 · published today

Summary

Versions 5.0.0 through 5.6.2 of Eclipse Kura let a user with only basic wiring permissions change the settings of other system components, including security‑related ones, or replace them entirely. This can give the attacker full administrative control and disrupt the device. Upgrade to Eclipse Kura 5.6.3 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
eclipse foundation	eclipse kura	<= 5.6.2

Original advisory text

In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.rest.wire.provider), determine whether a configuration update targets a Wire Component, Driver or Asset from the factory identifier supplied in the request, instead of the actual factory of the existing component. An authenticated identity holding only the Wires management permission (kura.wires.admin for the Web UI, rest.wires.admin for the REST API) can therefore modify the configuration of existing components that are not part of the Wire Graph, including security-relevant ones, or replace existing components. This allows escalation to full administrative privileges and can disrupt the device. Modifying arbitrary components requires at least one Driver to be installed on the device. The issue is fixed in Eclipse Kura 5.6.3.

References

Type

CWE-807Reliance on Untrusted Inputs in a Security Decision

CWE-863Incorrect Authorization

Timeline

Published10 Nov 2026

Updated10 Nov 2026

First seen10 Nov 2026

Sources

CVE-2026-113422 · NVD

CVE-2026-113422 · MITRE

Track software like this

Free during beta