CVE-2026-71277: falha crítica em iot-ecology rust-iot-platform
rust-iot-platform Authentication Bypass via Non-Validated Authorization Header
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.4%
rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. ) satisfies the guard, granting access to every endpoint protected only by this request guard.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
iot-ecology · rust-iot-platformCVEs relacionadas — iot-ecology rust-iot-platform
No mesmo produto, das mais perigosas para as menos.
CVE-2026-82452CRITICALrust-iot-platform Authentication Bypass via Missing Request GuardsEPSS 0.8%CVE-2026-71278CRITICALrust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script EvaluationEPSS 0.7%CVE-2026-82453HIGHrust-iot-platform Cleartext Password Storage via User ModelEPSS 0.5%