CVE-2026-13699

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-13699

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13699.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-13699

Published

2026-07-14T07:38:23.271Z

Modified

2026-07-17T03:45:45.865446143Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Databroker 0.6.1 PublishValue missing data_point panic

Details

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional datapoint field in PublishValueRequest. When a request contains a valid signalid but omits datapoint, the server directly calls unwrap() on request.datapoint, triggering a panic in the Tokio worker thread. This issue can be triggered by any client holding a valid JWT token. Unauthenticated or invalid-token requests are rejected and do not reach the vulnerable path. The panic causes the individual gRPC call to be cancelled but does not terminate the Databroker process, which remains available for subsequent requests.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13699.json",
    "cwe_ids": [
        "CWE-20"
    ],
    "cna_assigner": "eclipse",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.6.1"
                },
                {
                    "last_affected": "0.6.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/eclipse-kuksa/kuksa-databroker

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-kuksa/kuksa-databroker

Events

Introduced

dd9cb5d1c2da2543dd3b3aa7e5fb350d07412c66

Last affected

dd9cb5d1c2da2543dd3b3aa7e5fb350d07412c66

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.6.1"
        },
        {
            "last_affected": "0.6.1"
        }
    ],
    "cpe": "cpe:2.3:a:eclipse:kuksa:0.6.1:*:*:*:*:*:*:*",
    "source": "CPE_STRING"
}

Affected versions

0.*

0.6.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13699.json"