CVE-2026-112191

CVSS 8.6 (high) · published 2026-11-10

In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3.

Weakness: CWE-269, CWE-863

Source: NVD CVE-2026-112191

References

• https://github.com/eclipse-kura/kura/security/advisories/GHSA-v8gf-9w4p-662w
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/431

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.