Eclipse Kura up to 5.6.1 Web Console/REST API getRemoteAddr X-Forwarded-For injection

Summaryinfo

A vulnerability, which was classified as very critical, was found in Eclipse Kura up to 5.6.1. This vulnerability affects the function getRemoteAddr of the component Web Console/REST API. The manipulation of the argument X-Forwarded-For results in injection. This vulnerability is reported as CVE-2026-9561. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Eclipse Kura up to 5.6.1. Affected is the function getRemoteAddr of the component Web Console/REST API. The manipulation of the argument X-Forwarded-For with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.

The advisory is available at gitlab.eclipse.org. This vulnerability is traded as CVE-2026-9561 since 05/26/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/14/2026). This vulnerability is assigned to T1055 by the MITRE ATT&CK project.

Upgrading to version 5.6.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Eclipse

Name

• Kura

Version

• 5.6.0
• 5.6.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion