Medium severity · published Jul 14, 2026
CVE-2026-13699
Databroker 0.6.1 PublishValue missing data_point panic
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest. When a request contains a valid signal_id but omits data_point, the server directly calls unwrap() on request.data_point, triggering a panic in the Tokio worker thread. This issue can be triggered by any client holding a valid JWT token. Unauthenticated or invalid-token requests are rejected and do not reach the vulnerable path. The panic causes the individual gRPC call to be cancelled but does not terminate the Databroker process, which remains available for subsequent requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EK
Eclipse KUKSA - Databroker · Eclipse Foundation
0.6.1 · source: vendor
KU
Kuksa · Eclipse
0.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13699
Issue Tracking
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/148
More from Eclipse KUKSA - Databroker
8.5
CVE-2026-6272
A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest
