High severity · published Apr 24, 2026
CVE-2026-6272
A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest
8.5
CVSS
0.3%
EPSS
No
On KEV
Description
A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest.
1. Obtain any valid token with only read scope.
2. Connect to the normal production gRPC API (kuksa.val.v2).
3. Open OpenProviderStream.
4. Send ProvideSignalRequest for a target signal ID.
5. Wait for the broker to forward GetProviderValueRequest.
6. Reply with attacker-controlled GetProviderValueResponse.
7. Other clients performing GetValue / GetValues for that signal receive forged data.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EK
Eclipse KUKSA - Databroker · Eclipse Foundation
0.5.0 through 0.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6272
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6272
gitlab.eclipse.org
https://gitlab.eclipse.org/security/cve-assignment/-/issues/98
More from Eclipse KUKSA - Databroker
6.5
CVE-2026-13699
Databroker 0.6.1 PublishValue missing data_point panic