AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-29T14:16:38.347Z and has not been modified since then. The vulnerability involves storing user passwords in cleartext without hashing in the user model of rust-iot-platform. This weakness allows attackers to obtain plaintext credentials by reading API responses from user retrieval and listing routes [truncated]
The CVE-2026-71278 vulnerability in rust-iot-platform allows unauthenticated attackers to execute arbitrary JavaScript in the server process. This is possible because the POST /calc-rule/create endpoint does not require authentication and the executed script is not sandboxed. The vulnerability impacts operators who should review calc rule configurations, verify authenticity of creations, and prioritize pa [truncated]
The CVE-2026-71277 record was published on 2026-08-05T13:24:52.200Z. The AuthToken request-guard implementation in rust-iot-platform's api/src/main.rs only checks for the Authorization HTTP header presence, not its value against any session, token store, or signature. This allows arbitrary non-empty Authorization headers to grant access to protected endpoints. Users should review and verify endpoint prote [truncated]
