CVE-2026-82452

CVSS 9.8 (critical) · published 2026-08-29

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.

Weakness: CWE-306

Source: NVD CVE-2026-82452

References

• https://github.com/iot-ecology/rust-iot-platform
• https://github.com/iot-ecology/rust-iot-platform/blob/5df942ab6bc46a3bf83dbee8c7970554f92c972d/api/src/controller/user_router.rs
• https://www.vulncheck.com/advisories/rust-iot-platform-authentication-bypass-via-missing-request-guards

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.