CVE-2026-82453: rust-iot-platform Cleartext Password Storage via User Model

Q: Who can exploit this issue?

An attacker who can read responses from the application's user retrieval or user-listing API routes can obtain plaintext credentials for all accounts. The issue is remotely exploitable and requires no authentication or user interaction according to the supplied vector.

Q: Are password hashes exposed, or actual passwords?

The affected user model stores passwords in cleartext rather than hashing them. The user retrieval and listing routes can therefore expose usable plaintext credentials.

Q: How can I determine whether my deployment is affected?

Deployments of rust-iot-platform through commit 5df942ab are affected. Review responses from user retrieval and listing routes and inspect the user model to determine whether password fields are stored or returned in cleartext.

Published Aug 29, 2026

Updated

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

Affected Software

1 affected component

rust-iot-platform<5df942ab

Event History

Aug 29, 2026

CVE Published

via MITRE·01:47 PM

Data Sourced

via MITRE·01:47 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker who can read responses from the application's user retrieval or user-listing API routes can obtain plaintext credentials for all accounts. The issue is remotely exploitable and requires no authentication or user interaction according to the supplied vector.

Are password hashes exposed, or actual passwords?

The affected user model stores passwords in cleartext rather than hashing them. The user retrieval and listing routes can therefore expose usable plaintext credentials.

How can I determine whether my deployment is affected?

Deployments of rust-iot-platform through commit 5df942ab are affected. Review responses from user retrieval and listing routes and inspect the user model to determine whether password fields are stored or returned in cleartext.

CVE-2026-82453: rust-iot-platform Cleartext Password Storage via User Model

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are password hashes exposed, or actual passwords?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are password hashes exposed, or actual passwords?

How can I determine whether my deployment is affected?