gRPC Handler Vulnerability in Eclipse KUKSA Databroker

CVE-2026-13699

What is CVE-2026-13699?

In Eclipse KUKSA Databroker version 0.6.1, a vulnerability exists in the gRPC handler that fails to properly validate the optional data_point field in the PublishValueRequest. This situation arises when a valid signal_id is provided without including the data_point, resulting in an unprotected call to unwrap() on request.data_point. Such a condition leads to a panic in the Tokio worker thread, although requests with unauthenticated or invalid tokens are suitably blocked from exploiting this flaw. While the panic cancels the specific gRPC call, it does not affect the overall availability of the Databroker process, allowing it to handle subsequent requests.

References