CVE-2026-94293: Missing authentication for critical function in the aas-edge-client REST API
Published Oct 6, 2026
·Updated
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
Affected Software
1 affected component
aas-edge-client
Event History
Oct 6, 2026
CVE Published
via MITRE·06:38 AM
Data Sourced
via MITRE·06:38 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
No authentication or prior privileges are required. A remote attacker can exploit the affected REST API over the network.
2
What can an attacker do through the affected API?
An attacker can read all data exposed by GET endpoints and modify Asset Administration Shell submodel data using PATCH requests. The reported impact includes confidentiality, integrity, and availability.