Eclipse Kura: Authenticated privilege escalation via Wire Service REST API (CVE-2026-113422)

Eclipse Kura versions 5.0.0 through 5.6.2 are vulnerable to an authenticated privilege escalation issue within the Wire Graph update functionality of the Kura Web UI and the Wire Service REST API v1. An authenticated identity with limited permissions (kura.wires.admin or rest.wires.admin) can provide a manipulated factory identifier in a configuration request. The system incorrectly trusts this identifier to determine the target component, allowing the user to modify or replace security-relevant components outside the intended Wire Graph. This vulnerability requires at least one Driver to be installed on the device.

Impact

Successful exploitation allows an authenticated user with restricted Wires management privileges to gain full administrative control over the Eclipse Kura device or cause operational disruption.

Recommendation

• Upgrade Eclipse Kura to version 5.6.3 or later immediately to remediate CVE-2026-113422.
• Restrict access to the Kura Web UI and Wire Service REST API to trusted administrative accounts only.
• Audit existing user permissions to ensure the 'kura.wires.admin' and 'rest.wires.admin' roles are assigned only to authorized personnel.