The vulnerability allows a client that holds only a read‑scope JWT to register itself as a signal provider via the OpenProviderStream API. By sending a ProvideSignalRequest, the client can spoof any target signal ID, receive a GetProviderValueRequest from the broker, and return an attacker‑controlled response. The effect is that all other clients calling GetValue or GetValues for that signal receive forged data, leading to data integrity lapses and potentially false sensor readings.

Eclipse Foundation’s Eclipse KUKSA Databroker, specifically versions using the production kuksa.val.v2 gRPC interface. The vulnerability applies to any deployment that accepts externally signed JWTs with read privileges and allows clients to establish OpenProviderStream connections. Specific version numbers are not listed in the documentation.

The flaw carries a CVSS score of 8.5, indicating a high severity. The EPSS score is below 1%, indicating a low but non‑zero probability of exploitation in the wild, and the issue is not yet listed in CISA’s KEV catalog. The attack vector is remote, using a standard gRPC connection. An attacker only needs a valid JWT with read scope, which they could obtain legitimately or via credential compromise, to abuse the API. Once a malicious provider is registered, any consumer request for the forged signal will be served with attacker‑controlled data.