Publicly Listable Azure Blob Storage Vulnerability in Gardyn Device Logs
CVE-2026-55726

6.9MEDIUM

Key Information:

Vendor

Gardyn

Status
Gardyn Home Firmware
Gardyn Studio Firmware
Gardyn Cloud Api
Vendor
CVE Published:
2 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-55726?

The Azure Blob Storage container utilized for Gardyn device logs is configured to be publicly accessible without any form of authentication. This vulnerability permits unauthorized users to list and access device log files stored within the blob storage container. Malicious actors could exploit this weakness to view sensitive operational data, potentially compromising user privacy and device functionality.

Affected Version(s)

Gardyn Cloud API 0 < 2.12.2026

Gardyn Home Firmware 0

Gardyn Studio Firmware 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-55726
Created by MichaelAdamGroberman

References

https://mygardyn.com/security/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-1...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Groberman reported this vulnerability to CISA.
.