CVE-2026-82453

rust-iot-platform through commit 5df942ab stores user passwords in cleartext in its user model instead of hashing them (CWE-256, Plaintext Storage of a Password). The user retrieval and user listing API routes return these user records, so an attacker with network access to those endpoints can read plaintext passwords for all accounts; the CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates the endpoints can be reached without privileges or user interaction. An attacker gains the plaintext credentials of every account on the platform, enabling account takeover and reuse of passwords against other systems where users reused credentials. Any deployment of the project at or before commit 5df942ab is affected, though the number of deployed instances is not publicly documented. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS currently estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Determine whether your deployment is at or before commit 5df942ab and check the upstream repository for a patched commit, as the advisory does not specify a fixed version. As interim mitigations, restrict access to the user retrieval and listing API routes and rotate any passwords that may have been exposed through those endpoints. Once a fix is available, upgrade and confirm that stored passwords are migrated to salted hashes, forcing resets for accounts whose plaintext credentials were retrievable.