CVE-2026-9561: High severity Eclipse Kura vulnerability
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse Kurato a version that resolves this vulnerability.Fixed in 5.6.2 - Configuration
Stop using the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries; initialize audit context using a trusted IP source instead.
Eclipse Kura Web Console / REST API (org.eclipse.kura.web2, org.eclipse.kura.rest.provider) Trust of client-supplied X-Forwarded-For = Do not trust X-Forwarded-For as authoritative client IP for audit context - Configuration
Avoid unconditionally installing Jetty ForwardedRequestCustomizer on all HTTP/HTTPS connectors; configure it so HttpServletRequest.getRemoteAddr() does not reflect attacker-controlled forwarded header values.
Eclipse Kura Jetty customizer (org.eclipse.kura.jetty.customizer) ForwardedRequestCustomizer installation = Install conditionally (or not unconditionally)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9561?
CVE-2026-9561 has a risk score of 45, indicating a moderate severity level.
How do I fix CVE-2026-9561?
To address CVE-2026-9561, upgrade to Eclipse Kura version 5.6.2 or later.
What components are affected by CVE-2026-9561?
CVE-2026-9561 affects the org.eclipse.kura.web2 and org.eclipse.kura.rest.provider components.
What is the impact of exploiting CVE-2026-9561?
Exploiting CVE-2026-9561 can allow an attacker to manipulate audit log entries by spoofing the client IP address.
When was CVE-2026-9561 published?
CVE-2026-9561 was published on July 14, 2026.