CVE-2026-9561
Eclipse Kura IP Address Spoofing Vulnerability
Description
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.
INFO
Published Date :
July 14, 2026, 9:16 a.m.
Last Modified :
Oct. 24, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | e51fbebd-6053-4e49-959f-1b94eeb69a2c | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Eclipse Kura to version 5.6.2 or later.
- Review and secure HTTP headers.
- Implement IP address validation.
- Monitor network access logs.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-9561.
| URL | Resource |
|---|---|
| https://gitlab.eclipse.org/security/cve-assignment/-/work_items/117 | Exploit Issue Tracking Patch Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-9561 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-9561
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-9561 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-9561 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: Eclipse Kura de Eclipse Foundation, Description: Las versiones de Eclipse Kura anteriores a la 5.6.2 confían en el encabezado HTTP X-Forwarded-For proporcionado por el cliente como la fuente autorizada de la dirección IP del cliente en las entradas del registro de auditoría. Los componentes org.eclipse.kura.web2 (Consola Web) y org.eclipse.kura.rest.provider (API REST) utilizan este encabezado como la fuente IP principal al inicializar el contexto de auditoría, y org.eclipse.kura.jetty.customizer instala incondicionalmente el ForwardedRequestCustomizer de Jetty en todos los conectores HTTP/HTTPS, lo que hace que HttpServletRequest.getRemoteAddr() refleje el valor del encabezado controlado por el atacante. Un atacante remoto no autenticado puede explotar esta vulnerabilidad para eludir las protecciones de fuerza bruta basadas en IP - como fail2ban - suplantando la dirección IP registrada a un valor no enrutable, permitiendo que un ataque de fuerza bruta proceda sin ser detectado, o para causar una denegación de servicio contra un tercero inyectando la dirección IP de una víctima y desencadenando una prohibición en esa dirección. -
Initial Analysis by [email protected]
Aug. 18, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Added CPE Configuration OR *cpe:2.3:a:eclipse:kura:*:*:*:*:*:*:*:* versions from (including) 5.0.0 up to (excluding) 5.6.2 Added Reference Type Eclipse Foundation: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/117 Types: Exploit, Issue Tracking, Patch, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 14, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-9561', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-14T12:21:53.290832Z'} -
New CVE Received by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/eclipse-kura/kura', 'vendor': 'Eclipse Foundation', 'product': 'Eclipse Kura', 'versions': [{'status': 'affected', 'version': '5.0.0', 'versionType': 'semver', 'lessThanOrEqual': '5.6.1'}], 'defaultStatus': 'unaffected'}] Added Description Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-345 Added CWE CWE-348 Added CWE CWE-807 Added Reference https://gitlab.eclipse.org/security/cve-assignment/-/work_items/117