CVE-2026-71278

CriticalCVSS 9.8

Published: 05/08/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

39th percentile - higher than 39% of all known CVEs

Summary

rust-iot-platform allows creating a 'calc rule' via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.

Risk Assessment

An unauthenticated attacker can create calc rules, potentially leading to unauthorized system changes, data manipulation, or disruption.

Recommendation

Add the AuthToken guard to the /calc-rule/create route. Also review all routes for missing security controls.

Original NVD description (English source)

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.