CVE-2026-112185

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112185

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112185.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112185

Aliases

GHSA-gqr7-j252-qwqx

Published

2026-11-10T16:58:30Z

Modified

2026-11-11T02:48:51Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

[none]

Details

In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated identity holding only the rest.configuration permission can read the password hashes of all identities, including administrators, which are stored as unsalted SHA-256 digests. The same identity can also modify identities and permission assignments, and restore previous configuration snapshots, which allows escalation to full administrative privileges. The issue is fixed in Eclipse Kura 5.6.3.

Database specific

{
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-522",
        "CWE-668",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112185.json"
}

References

Affected packages

Git / github.com/eclipse-kura/kura

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-kura/kura

Events

Introduced

bfc7fe3aab486ca16dcd850c0eeb08dfa9f0b8c1

Last Affected

42ecc87c4dca3e4e11d4181493506d822f92aa6f

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "5.1.0"
                },
                {
                    "last_affected": "5.6.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112185.json"