Eclipse Kura up to 5.6.2 Wire Graph privileges management

Summaryinfo

A vulnerability described as problematic has been identified in Eclipse Kura up to 5.6.2. This affects an unknown function of the component Wire Graph. Such manipulation leads to privileges management. This vulnerability is referenced as CVE-2026-113422. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Eclipse Kura up to 5.6.2 and classified as problematic. Affected by this issue is an unknown code block of the component Wire Graph. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is integrity, and availability. CVE summarizes:

In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.rest.wire.provider), determine whether a configuration update targets a Wire Component, Driver or Asset from the factory identifier supplied in the request, instead of the actual factory of the existing component. An authenticated identity holding only the Wires management permission (kura.wires.admin for the Web UI, rest.wires.admin for the REST API) can therefore modify the configuration of existing components that are not part of the Wire Graph, including security-relevant ones, or replace existing components. This allows escalation to full administrative privileges and can disrupt the device. Modifying arbitrary components requires at least one Driver to be installed on the device. The issue is fixed in Eclipse Kura 5.6.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-113422 since 10/20/2026. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 5.6.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Eclipse

Name

• Kura

Version

• 5.6.0
• 5.6.1
• 5.6.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion