CVE-2026-9561: eclipse foundation eclipse kura

Vulnerability summary

CVE-2026-9561 is a high (CVSS 8.8) vulnerability in eclipse foundation eclipse kura. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-07-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.

• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
• CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
• CWE-807Reliance on Untrusted Inputs in a Security DecisionThe product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.