The CVE-2026-71278 vulnerability in rust-iot-platform allows unauthenticated attackers to execute arbitrary JavaScript in the server process. This is possible because the POST /calc-rule/create endpoint does not require authentication and the executed script is not sandboxed. The vulnerability impacts operators who should review calc rule configurations, verify authenticity of creations, and prioritize pa [truncated]
The CVE-2026-71277 record was published on 2026-08-05T13:24:52.200Z. The AuthToken request-guard implementation in rust-iot-platform's api/src/main.rs only checks for the Authorization HTTP header presence, not its value against any session, token store, or signature. This allows arbitrary non-empty Authorization headers to grant access to protected endpoints. Users should review and verify endpoint prote [truncated]
