CVE-2026-113422
Description
In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.rest.wire.provider), determine whether a configuration update targets a Wire Component, Driver or Asset from the factory identifier supplied in the request, instead of the actual factory of the existing component. An authenticated identity holding only the Wires management permission (kura.wires.admin for the Web UI, rest.wires.admin for the REST API) can therefore modify the configuration of existing components that are not part of the Wire Graph, including security-relevant ones, or replace existing components. This allows escalation to full administrative privileges and can disrupt the device. Modifying arbitrary components requires at least one Driver to be installed on the device. The issue is fixed in Eclipse Kura 5.6.3.
Is your site exposed to CVE-2026-113422?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-113422? +
How do I check if I'm vulnerable to CVE-2026-113422? +
Related Vulnerabilities
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP …
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses …
By utilizing software-defined radios and a custom low-latency processing pipeline, RF signals with spoofed location data can be transmitted to …
A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian …
Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge …
A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally …
