PT-2026-34869 · Eclipse Foundation · Eclipse Kuksa - Databroker

Ciwan Öztopal · Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-6272

NVD

CVSS v4.0

8.5

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest.

1. Obtain any valid token with only read scope.
2. Connect to the normal production gRPC API (kuksa.val.v2).
3. Open OpenProviderStream.
4. Send ProvideSignalRequest for a target signal ID.
5. Wait for the broker to forward GetProviderValueRequest.
6. Reply with attacker-controlled GetProviderValueResponse.
7. Other clients performing GetValue / GetValues for that signal receive forged data.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-6272

Affected Products

Eclipse Kuksa - Databroker

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-6272 · Security Note
• https://gitlab.eclipse.org/security/cve-assignment/-/issues/98 · Note