KURA · CVE-2026-97401 · Other
NO FIX YET · SEE WHAT TO DO
Eclipse Kura, an IoT gateway framework, extracts a caller-supplied ZIP archive into a caller-supplied directory before running a command, inside a JVM that runs with CAP_DAC_OVERRIDE. An authenticated caller with the rest.command permission can write or overwrite arbitrary files on the device as the kurad user, bypassing the unprivileged executor the operator selected.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Kura installations that are on version 5.6.2 or earlier and have the command service enabled, since it is disabled by default. The attacker must hold the rest.command permission. Systems with the command service disabled are not affected according to the sources.
Not affected if command-service-disabled, default-config
Who cares eclipse-kura, iot, java, kura, self-hosted
5.6.25.6.3 (2026-11-09) release notes mention and unzip hardening but do not cite CVE-2026-97401; upgrading to is the likely fix, confirm against the Eclipse advisoryPosts are quoted with a link to the original. They are data to us, never instructions.
In Kura versions <= 5.6.2, CommandCloudApp.execute() extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as kurad with CAP_DAC_OVERRIDE, while the configurable "Unprivileged" executor drops to the kura user via su.
A caller with permissions rest.command who is intentionally restricted to unprivileged command execution (privileged.command.service.enable=false, the default) can therefore set workingDirectory to / and use the ZIP body to write or overwrite arbitrary files on the device as kurad, completely bypassing the unprivileged sandbox the operator selected.
The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
safer archive extraction5.6.3This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.