CVE-2026-6272
A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by se...
Original description
The description as published by the source.
A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest.
- Obtain any valid token with only read scope.
- Connect to the normal production gRPC API (kuksa.val.v2).
- Open OpenProviderStream.
- Send ProvideSignalRequest for a target signal ID.
- Wait for the broker to forward GetProviderValueRequest.
- Reply with attacker-controlled GetProviderValueResponse.
- Other clients performing GetValue / GetValues for that signal receive forged data.
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- report gitlab.eclipse.org