Unauthorized Signal Manipulation in gRPC API by Vulnerable Vendor

CVE-2026-6272

What is CVE-2026-6272?

The kuksa.val.v2 gRPC API contains a vulnerability that allows a client possessing only a read JWT scope to self-register as a signal provider. By crafting a ProvideSignalRequest using a valid token, the attacker can exploit the OpenProviderStream API. This enables them to supply manipulated responses for GetProviderValueRequest from a broker, impacting data integrity for clients retrieving GetValue or GetValues for that signal. The risk is significant, as compromised signal data can mislead users and applications relying on accurate information.

References