Kura vulnerabilities

2 known vulnerabilities in Kura from Eclipse Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Eclipse Kura: Insufficient Verification of Data Authenticity

  CVE-2026-9561Jul 14, 2026Eclipse Foundation

  Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) componen

• 7.5 High severity

  Kura: Incorrect Implementation of Authentication Algorithm

  CVE-2024-3046Apr 9, 2024Eclipse Foundation

  In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to retrieve the device logs. Also, downloaded logs may be used by an attacker to perform privilege escalat