{"id":"CVE-2026-97401","kind":"vulnerability","aliases":["CVE-2026-97401"],"related":[],"title":"Kura: REST command ZIP extraction lets unprivileged callers write arbitrary device files","description":"In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable \"Unprivileged\" executor drops to the `kura` user via `su`.\n\n\n\nA caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.\n\n\n\n[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94","summary":"Eclipse Kura, an IoT gateway framework, extracts a caller-supplied ZIP archive into a caller-supplied directory before running a command, inside a JVM that runs with CAP_DAC_OVERRIDE. An authenticated caller with the rest.command permission can write or overwrite arbitrary files on the device as the kurad user, bypassing the unprivileged executor the operator selected.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Kura","fixed":[],"affected":"<= 5.6.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["eclipse-kura","iot","java","kura","other","self-hosted"],"not_affected_if":["command-service-disabled","default-config"],"how_to_check":"- Check the installed Kura version; <= 5.6.2 is in the affected range (5.6.3 released 2026-11-09 has archive extraction hardening, not yet tied to this CVE by the vendor).\n- Look for the command service being enabled in the Kura configuration (privileged.command.service.enable). Default false since 4.0.0; the CVE text says the issue does not apply when the command service is disabled.\n- List identities holding the rest.command permission; they can POST zipBytes plus workingDirectory to /services/command/v1/command/.","fix":"Fixed version not confirmed by the vendor for this CVE. Affected is <= 5.6.2. Kura 5.6.3 (2026-11-09) release notes mention 'safer archive extraction' and unzip hardening but do not cite CVE-2026-97401; upgrading to 5.6.3 is the likely fix, confirm against the Eclipse advisory. Until then, keep privileged.command.service.enable=false and restrict rest.command.","status":"open","published_at":"2026-11-10T17:17:55+00:00","first_seen_at":"2026-11-10T17:22:45+00:00","triaged_at":"2026-11-10T17:23:58+00:00","updated_at":"2026-11-10T17:25:13+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T17:23:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kura: REST command ZIP extraction lets unprivileged callers write arbitrary device files","impact":"high","summary":"Eclipse Kura, an IoT gateway framework, extracts a caller-supplied ZIP archive into a caller-supplied directory before running a command, inside a JVM that runs with CAP_DAC_OVERRIDE. An authenticated caller with the rest.command permission can write or overwrite arbitrary files on the device as the kurad user, bypassing the unprivileged executor the operator selected.","audience":"businesses","category":"other","nicknames":[],"who_cares":["kura","eclipse-kura","iot","self-hosted","java"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker writes or overwrites arbitrary device files as kurad user","analyst_note":"Confirm the fixed version and the vendor advisory for CVE-2026-97401; the sources give only the affected range and the release-notes reference.","how_to_check":"- Check whether the command service is enabled by looking for `privileged.command.service.enable=true` in the Kura configuration; the default is `false`, and the issue does not apply when it is disabled.\n- Check the Kura version with the installed package; versions `<= 5.6.2` are affected.\n- Check which users hold the `rest.command` permission.","plain_action":"","product_name":"Kura","needs_analyst":true,"not_affected_if":["command-service-disabled","default-config"],"who_is_affected":"Only Kura installations that are on version 5.6.2 or earlier and have the command service enabled, since it is disabled by default. The attacker must hold the rest.command permission. Systems with the command service disabled are not affected according to the sources.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000815,"input_tokens":4850,"output_tokens":660,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the vendor advisory for CVE-2026-97401; the sources give only the affected range and the release-notes reference.","search":"'-2026':14A,17A '-97401':15A,18A '/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/release_notes.txt#l94':217C '1':202C,214C '4.0.0':201C '5.6.2':92C 'appli':207C 'arbitrari':10A,73B,177C 'archiv':42B,100C 'authent':63B 'bodi':172C 'bypass':82B,185C 'caller':8A,39B,46B,64B,97C,104C,147C 'caller-suppli':38B,45B,96C,103C 'cap':59B,131C 'command':3A,52B,115C,157C,193C,210C 'commandcloudapp.execute':93C 'complet':184C 'configur':136C 'cve':13A,16A 'dac':60B,132C 'default':162C,198C 'devic':11A,77B,181C 'directori':48B,106C 'disabl':196C,213C 'dispatch':113C 'drop':139C 'eclips':21B,30B 'eclipse-kura':20B 'execut':158C 'executor':85B,118C,138C 'extract':5A,36B,94C 'fals':160C 'file':12A,74B,178C 'framework':35B 'gateway':34B 'github.com':216C 'github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/release_notes.txt#l94':215C 'host':29B 'insid':53B,107C 'instal':124C 'intent':153C 'iot':23B,33B 'issu':204C 'java':24B 'jvm':55B,110C,126C 'kura':1A,19A,22B,25B,31B,90C,109C,123C,142C,200C 'kurad':80B,129C,183C 'let':6A 'oper':87B,190C 'overrid':61B,133C 'overwrit':72B,176C 'packag':122C 'permiss':68B,149C 'privileged.command.service.enable':159C 'process':111C 'rest':2A 'rest.command':67B,150C 'restrict':154C 'run':50B,57B,127C 'sandbox':188C 'select':88B,191C 'self':28B 'self-host':27B 'servic':119C,194C,211C 'set':165C 'sinc':199C 'su':145C 'suppli':40B,47B,98C,105C 'therefor':164C 'unprivileg':7A,84B,137C,156C,187C 'use':169C 'user':81B,143C 'version':91C 'via':144C 'workingdirectori':166C 'write':9A,70B,174C 'zip':4A,41B,99C,171C","nicknames":[],"mitigations":[],"who_affected":"Only Kura installations that are on version 5.6.2 or earlier and have the command service enabled, since it is disabled by default. The attacker must hold the rest.command permission. Systems with the command service disabled are not affected according to the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["kura"],"ptokens":["kura"],"labels":["eclipsekura","high","iot","java","kura","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-97401':15A,18A 'arbitrari':10A 'caller':8A 'command':3A 'cve':13A,16A 'devic':11A 'extract':5A 'file':12A 'kura':1A,19A 'let':6A 'rest':2A 'unprivileg':7A 'write':9A 'zip':4A","search_b":"'arbitrari':73B 'archiv':42B 'authent':63B 'bypass':82B 'caller':39B,46B,64B 'caller-suppli':38B,45B 'cap':59B 'command':52B 'dac':60B 'devic':77B 'directori':48B 'eclips':21B,30B 'eclipse-kura':20B 'executor':85B 'extract':36B 'file':74B 'framework':35B 'gateway':34B 'host':29B 'insid':53B 'iot':23B,33B 'java':24B 'jvm':55B 'kura':22B,25B,31B 'kurad':80B 'oper':87B 'overrid':61B 'overwrit':72B 'permiss':68B 'rest.command':67B 'run':50B,57B 'select':88B 'self':28B 'self-host':27B 'suppli':40B,47B 'unprivileg':84B 'user':81B 'write':70B 'zip':41B","search_c":"'/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/release_notes.txt#l94':217C '1':202C,214C '4.0.0':201C '5.6.2':92C 'appli':207C 'arbitrari':177C 'archiv':100C 'bodi':172C 'bypass':185C 'caller':97C,104C,147C 'caller-suppli':96C,103C 'cap':131C 'command':115C,157C,193C,210C 'commandcloudapp.execute':93C 'complet':184C 'configur':136C 'dac':132C 'default':162C,198C 'devic':181C 'directori':106C 'disabl':196C,213C 'dispatch':113C 'drop':139C 'execut':158C 'executor':118C,138C 'extract':94C 'fals':160C 'file':178C 'github.com':216C 'github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/release_notes.txt#l94':215C 'insid':107C 'instal':124C 'intent':153C 'issu':204C 'jvm':110C,126C 'kura':90C,109C,123C,142C,200C 'kurad':129C,183C 'oper':190C 'overrid':133C 'overwrit':176C 'packag':122C 'permiss':149C 'privileged.command.service.enable':159C 'process':111C 'rest.command':150C 'restrict':154C 'run':127C 'sandbox':188C 'select':191C 'servic':119C,194C,211C 'set':165C 'sinc':199C 'su':145C 'suppli':98C,105C 'therefor':164C 'unprivileg':137C,156C,187C 'use':169C 'user':143C 'version':91C 'via':144C 'workingdirectori':166C 'write':174C 'zip':99C,171C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97401","severity":null,"published_at":"2026-11-10T17:17:55+00:00","modified_at":"2026-11-10T17:17:55+00:00","first_seen_at":"2026-11-10T17:22:45+00:00","fetched_at":"2026-11-10T17:22:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97401:2473","url":"https://github.com/eclipse-kura/kura/releases","severity":null,"published_at":"2026-11-10T17:25:13+00:00","modified_at":"2026-11-10T17:25:13+00:00","first_seen_at":"2026-11-10T17:25:13+00:00","fetched_at":"2026-11-10T17:25:13+00:00","note":"No vendor advisory or GitLab cve-assignment entry found for this CVE yet. Kura 5.6.3 (released 2026-11-09) release notes list 'Safer archive extraction' and a Command tab fix but do not name this CVE, so the fix is not confirmed. Nothing marked verified. Revisit when the Eclipse advisory appears.","cites":["https://github.com/eclipse-kura/kura/releases","https://eclipse-kura.github.io/kura/docs-develop/references/rest-apis/rest-command-api/"]}],"documents":[{"id":115752,"url":"https://github.com/eclipse-kura/kura/releases","title":"Eclipse Kura 5.6.3 release notes (Nov 2026)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":116638,"url":"https://eclipse-kura.github.io/kura/docs-develop/references/rest-apis/rest-command-api/","title":"Kura REST Command v1 API (zipBytes, workingDirectory)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}