EXPOSURES › CVE-2026-82452
CVE-2026-82452
CRITICALrust-iot-platform lacks authentication guards on most REST API routes, allowing unauthenticated attackers to create, update, list, retrieve, and delete user accounts.
The rust-iot-platform software shipped by vendors lacks authentication guards on most REST API routes, enabling unauthenticated attackers to fully compromise user accounts without credentials. This is a critical failure for DIB organizations because it directly violates CMMC/NIST 800-171 requirements for access control and authentication, allowing attackers to pivot into the system. Organizations must verify that all API endpoints are properly guarded and that authentication is enforced at the application level, not just the network level.
Shame score — A critical authentication bypass that allows complete account takeover without credentials is a severe, avoidable failure that shatters trust in the vendor's security posture.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.