CVE-2026-82452

rust-iot-platform through commit 5df942ab suffers from a missing-authentication flaw (CWE-306): most REST API routes do not include authentication guards in their handler signatures, so they accept requests without validating any credentials. An unauthenticated attacker who can reach the service over the network can directly call these unprotected endpoints. This grants full unauthenticated control over user-account management, including the ability to create, update, list, retrieve, and delete user accounts, which could let an attacker add their own accounts or remove legitimate ones. Any operator running the affected code with the REST API reachable by untrusted clients is exposed. Exploitation has not been observed: no public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS estimates only a 0.5% probability of exploitation within 30 days.

What to do: Determine which commit your deployment runs; if it is at or before 5df942ab, treat the REST API as unauthenticated until a fix adding authentication guards to all handlers is released. As interim mitigation, restrict access to the API at the network layer (firewall rules, allowlists, or an authenticating reverse proxy) and audit user accounts for unauthorized additions or changes. Monitor the project and the VulnCheck advisory for a patched version, then upgrade and rotate any credentials that were exposed through the API.