CVE-2026-13699

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest. When a request contains a valid signal_id but omits data_point, the server directly calls unwrap() on request.data_point, triggering a panic in the Tokio worker thread. This issue can be triggered by any client holding a valid JWT token. Unauthenticated or invalid-token requests are rejected and do not reach the vulnerable path. The panic causes the individual gRPC call to be cancelled but does not terminate the Databroker process, which remains available for subsequent requests.

• CWE-20

• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/148Issue Tracking

Published

Jul 14, 2026

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13692The PayU CommercePro Plugin WordPress plugin before 3.9.0 do…5.3
• CVE-2026-13693The Bit Form WordPress plugin before 3.1.0 does not restric…5.9
• CVE-2026-13694The Bit Form WordPress plugin before 3.1.0 does not properl…6.5
• CVE-2026-13696Improper neutralization of special elements used in an LDAP …8.8
• CVE-2026-13697undici's cache interceptor mishandles malformed Cache-Contro…9.1
• CVE-2026-13698A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0…7.5
• CVE-2026-1370The SIBS woocommerce payment gateway plugin for WordPress is…4.9
• CVE-2026-13701The Advanced Excerpt WordPress plugin before 4.5 does not sa…4.8
• CVE-2026-13703The SEO Redirection Plugin WordPress plugin before 9.19 doe…5.4
• CVE-2026-13704The GiveWP – Donation Plugin and Fundraising Platform plugin…6.4
• CVE-2026-13705Imager versions before 1.032 for Perl have a heap out-of-bou…7.1
• CVE-2026-13706Improper input validation vulnerability in Wikimedia Foundat…8.8