Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-71277: rust-iot-platform: Unauthorized Access through Fake Authorization Headers
CVE-2026-71277
CVE-2026-71277
Summary
The rust-iot-platform has a security weakness that allows anyone to access protected areas of the system by sending a fake Authorization header. This is a concern because it means unauthorized users can access sensitive data and perform actions they shouldn't be able to. To fix this, the platform's developers should update the AuthToken request-guard to properly validate the Authorization header against a session or token store.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| iot-ecology | rust-iot-platform | <= * |
Original title
rust-iot-platform Authentication Bypass via Non-Validated Authorization Header
Original description
rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. `Authorization: fake`) satisfies the guard, granting access to every endpoint protected only by this request guard.
nvd CVSS3.1
9.1
Vulnerability type
CWE-287
Improper Authentication
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026