CVE-2026-82452: rust-iot-platform Authentication Bypass via Missing Request Guards

Published Aug 29, 2026

Updated

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.

Affected Software

1 affected component

rust-iot-platform>undefined

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust-iot-platform to a version that resolves this vulnerability.
Patch 5df942ab

Event History

Aug 29, 2026

CVE Published

via MITRE·01:47 PM

Data Sourced

via MITRE·01:47 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit the affected endpoints?

Any unauthenticated remote attacker can access the unprotected REST API routes. No valid credentials or user interaction are required.

What actions can an attacker take through the exposed API?

An attacker can create, update, list, retrieve, and delete user accounts by directly calling REST endpoints that lack authentication guards.

Which versions are affected?

The issue is reported in rust-iot-platform through commit 5df942ab. No fixed version or remediation commit is provided in the available data.

CVE-2026-82452: rust-iot-platform Authentication Bypass via Missing Request Guards

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit the affected endpoints?

What actions can an attacker take through the exposed API?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit the affected endpoints?

What actions can an attacker take through the exposed API?

Which versions are affected?