CVE-2026-9561: High severity Eclipse Kura vulnerability
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse Kurato a version that resolves this vulnerability.Fixed in 5.6.2 - Compensating control
Ensure IP-based brute-force protections (e.g., fail2ban) cannot be bypassed by spoofed X-Forwarded-For by blocking/overriding the attacker-controlled X-Forwarded-For header at the reverse proxy/load balancer and forcing use of the actual connection source IP for logging/ban logic.
- Compensating control
Prevent third-party DoS via spoofed victim IPs by adding a control at the edge (reverse proxy/load balancer or WAF) that rejects or strips incoming X-Forwarded-For headers from untrusted clients.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9561?
CVE-2026-9561 has a risk score of 45, indicating a moderate severity level.
How do I fix CVE-2026-9561?
To address CVE-2026-9561, upgrade to Eclipse Kura version 5.6.2 or later.
What components are affected by CVE-2026-9561?
CVE-2026-9561 affects the org.eclipse.kura.web2 and org.eclipse.kura.rest.provider components.
What is the impact of exploiting CVE-2026-9561?
Exploiting CVE-2026-9561 can allow an attacker to manipulate audit log entries by spoofing the client IP address.
When was CVE-2026-9561 published?
CVE-2026-9561 was published on July 14, 2026.