CVE-2026-97401: Security vulnerability

Q: Are default Kura deployments affected?

No. The command service has been disabled by default since Kura 4.0.0, and the issue does not apply when that service is disabled. A deployment is exposed only if the command service has been enabled.

Q: What access does an attacker need to exploit this?

The attacker needs permissions for rest.command. Exploitation is relevant when that caller is restricted to the Unprivileged executor and privileged.command.service.enable=false, which is the default setting for that executor behavior.

Q: Why does the Unprivileged executor not contain the impact?

The ZIP archive is extracted before the command is dispatched to the executor service. On packaged installations, extraction occurs in the Kura JVM running as kurad with CAP_DAC_OVERRIDE, so a caller can choose / as workingDirectory and write or overwrite files before the process drops to the kura user.

Published Nov 10, 2026

Updated

In Kura versions <= 5.6.2, CommandCloudApp.execute() extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as kurad with CAPDACOVERRIDE, while the configurable "Unprivileged" executor drops to the kura user via su.

A caller with permissions rest.command who is intentionally restricted to unprivileged command execution (privileged.command.service.enable=false, the default) can therefore set workingDirectory to / and use the ZIP body to write or overwrite arbitrary files on the device as kurad, completely bypassing the unprivileged sandbox the operator selected.

The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.

[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASENOTES.txt#L94

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Disable the command service; the issue does not apply when the command service is disabled.
Kura command service command service enabled = false

Event History

Nov 10, 2026

CVE Published

via MITRE·05:06 PM

Data Sourced

via MITRE·05:06 PM

DescriptionWeakness

Frequently Asked Questions

Are default Kura deployments affected?

No. The command service has been disabled by default since Kura 4.0.0, and the issue does not apply when that service is disabled. A deployment is exposed only if the command service has been enabled.

What access does an attacker need to exploit this?

The attacker needs permissions for rest.command. Exploitation is relevant when that caller is restricted to the Unprivileged executor and privileged.command.service.enable=false, which is the default setting for that executor behavior.

Why does the Unprivileged executor not contain the impact?

The ZIP archive is extracted before the command is dispatched to the executor service. On packaged installations, extraction occurs in the Kura JVM running as kurad with CAP_DAC_OVERRIDE, so a caller can choose / as workingDirectory and write or overwrite files before the process drops to the kura user.

CVE-2026-97401: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Are default Kura deployments affected?

What access does an attacker need to exploit this?

Why does the Unprivileged executor not contain the impact?

Company

Resources

Contact

Frequently Asked Questions

Are default Kura deployments affected?

What access does an attacker need to exploit this?

Why does the Unprivileged executor not contain the impact?