CVE-2026-82452criticalCWE-306

CVE-2026-82452: critical vulnerability in iot-ecology rust-iot-platform

rust-iot-platform Authentication Bypass via Missing Request Guards

Published · Updated

Follow this CVE+ Monitor rust-iot-platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.8%
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
iot-ecology · rust-iot-platform
Related CVEs — iot-ecology rust-iot-platform

In the same product, most dangerous first.

CVE-2026-71278CRITICALrust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script EvaluationEPSS 0.7%CVE-2026-82453HIGHrust-iot-platform Cleartext Password Storage via User ModelEPSS 0.5%CVE-2026-71277CRITICALrust-iot-platform Authentication Bypass via Non-Validated Authorization HeaderEPSS 0.4%