CVE-2026-71278

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71278", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T12:23:34.967Z", "datePublished": "2026-08-05T12:26:24.720Z", "dateUpdated": "2026-08-10T11:46:58.434Z"}, "containers": {"cna": {"title": "rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation", "descriptions": [{"lang": "en", "value": "rust-iot-platform allows creating a \"calc rule\" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>rust-iot-platform allows creating a \"calc rule\" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94", "cweId": "CWE-94", "type": "CWE"}]}], "affected": [{"vendor": "iot-ecology", "product": "rust-iot-platform", "programFiles": ["api/src/controller/calc_rule_router.rs", "api/src/biz/calc_run_biz.rs"], "versions": [{"version": "0", "lessThanOrEqual": "*", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/iot-ecology/rust-iot-platform", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Alibek Baxtiyorov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:46:58.434Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T12:26:24.720Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:57:06.656815Z", "id": "CVE-2026-71278", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:57:11.734Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71278", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:57:06.656815Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:57:09.318Z"}}], "cna": {"title": "rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alibek Baxtiyorov"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "iot-ecology", "product": "rust-iot-platform", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "programFiles": ["api/src/controller/calc_rule_router.rs", "api/src/biz/calc_run_biz.rs"], "defaultStatus": "unaffected"}], "datePublic": "2026-08-05T12:26:24.720Z", "references": [{"url": "https://github.com/iot-ecology/rust-iot-platform", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "rust-iot-platform allows creating a \"calc rule\" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.", "supportingMedia": [{"type": "text/html", "value": "<p>rust-iot-platform allows creating a \"calc rule\" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:46:58.434Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71278", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:46:58.434Z", "dateReserved": "2026-08-05T12:23:34.967Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T12:26:24.720Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "rust-iot-platform", "programFiles": ["api/src/controller/calc_rule_router.rs", "api/src/biz/calc_run_biz.rs"], "vendor": "iot-ecology", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rust-iot-platform allows creating a \"calc rule\" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication."}, {"lang": "es", "value": "rust-IoT-platform permite crear una \u2019regla de c\u00e1lculo\u2019 v\u00eda POST /calc-rule/create (API/src/controller/calc_rule_router.rs) que contiene un campo \u2019script\u2019 arbitrario. Esta ruta no utiliza el guard de solicitud AuthToken usado en otras partes de la aplicaci\u00f3n, haci\u00e9ndola accesible sin autenticaci\u00f3n. El script almacenado se ejecuta posteriormente v\u00eda quick_js::Context::eval() en API/src/biz/calc_run_biz.rs sin sandboxing, permitiendo a un atacante no autenticado lograr la ejecuci\u00f3n arbitraria de JavaScript en el proceso del servidor al crear y activar una \u2019regla de c\u00e1lculo\u2019 maliciosa."}], "id": "CVE-2026-71278", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71278", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T15:57:06.656815Z", "version": "2.0.3"}}]}, "published": "2026-08-05T13:24:52.320", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/iot-ecology/rust-iot-platform"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "rust-iot-platform", "source": "cna", "vendor": "iot-ecology"}, "product": "rust-iot-platform", "vendor": "iot-ecology"}], "created": "2026-08-05T15:00:05.508569+00:00", "updated": "2026-08-10T21:15:07.179594+00:00", "vendors": ["iot-ecology", "iot-ecology$PRODUCT$rust-iot-platform"]}