CVE-2026-71278 — rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation

CVE-2026-71278

rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation PUBLISHED

Description (CNA)

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.

Affected (CNA)

Vendor / product	Versions
iot-ecology / rust-iot-platform	affected 0 through *

CWE

CWE-94

References

https://github.com/iot-ecology/rust-iot-platform

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.