Eclipse KUKSA 0.6.1 RPC handler kuksa.val.v2 unwrap data_point input validation

Summaryinfo

A vulnerability, which was classified as critical, was found in Eclipse KUKSA 0.6.1. Affected by this vulnerability is the function unwrap of the file kuksa.val.v2 of the component RPC handler. Executing a manipulation of the argument data_point can lead to input validation. This vulnerability appears as CVE-2026-13699. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Eclipse KUKSA 0.6.1. It has been declared as critical. This vulnerability affects the function unwrap of the file kuksa.val.v2 of the component RPC handler. The manipulation of the argument data_point with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. CVE summarizes:

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest. When a request contains a valid signal_id but omits data_point, the server directly calls unwrap() on request.data_point, triggering a panic in the Tokio worker thread. This issue can be triggered by any client holding a valid JWT token. Unauthenticated or invalid-token requests are rejected and do not reach the vulnerable path. The panic causes the individual gRPC call to be cancelled but does not terminate the Databroker process, which remains available for subsequent requests.

The advisory is shared for download at gitlab.eclipse.org. This vulnerability was named CVE-2026-13699 since 06/29/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/14/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• KUKSA

Version

• 0.6.1

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion