Description
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.
Published: 2026-07-14
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Eclipse Kura components trust the client‑supplied X‑Forwarded‑For HTTP header as the definitive client IP address for audit log entries. The Web Console and REST API use this header when initializing audit context, and Jetty’s ForwardedRequestCustomizer unconditionally installs on all HTTP/HTTPS connectors, causing the request’s remote address to reflect the attacker‑controlled header value. An unauthenticated remote attacker can therefore send requests with a forged X‑Forwarded‑For header to make the system believe the source IP is a non‑routable value or a victim’s IP, bypassing IP‑based brute‑force protections such as fail2ban or causing a denial of service by triggering a ban on a legitimate IP.

Affected Systems

The Eclipse Foundation’s, specifically the org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components in all releases prior to version 5.6.2.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.8, indicating a high severity threat. The EPSS score of less than 1% suggests a low current probability of exploitation, and it is not listed in CISA’s KEV catalog. Attackers can exploit it X‑Forwarded‑For header; no authentication is required, making the attack path straightforward for anyone with network access to the Kura appliance.

Generated by OpenCVE AI on August 1, 2026 at 10:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Eclipse Kura to version 5.6.2 or later, which removes the trust in the X‑Forwarded‑For header for audit logging.
  • If an upgrade cannot be performed immediately, reconfigure Jetty to exclude ForwardedRequestCustomizer or modify the web console and REST API to ignore the X‑Forwarded‑For header when initializing audit context.
  • Deploy additional network filtering or a reverse proxy that strips or validates the X‑Forwarded‑For header, and enforce IP‑based rate‑limiting or fail2ban based on the true source IP address rather than the header value.

Generated by OpenCVE AI on August 1, 2026 at 10:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 01 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Title X-Forwarded-For Header Spoofing Enables IP-Based Brute-Force and Denial of Service in Eclipse Kura

Wed, 29 Jul 2026 06:45:00 +0000

Type Values Removed Values Added
Title X-Forwarded-For Header Spoofing Enables IP-Based Brute-Force and Denial of Service in Eclipse Kura

Sun, 26 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title IP Spoofing via X-Forwarded-For Header to Bypass Brute-Force Protection and Cause Denial of Service

Thu, 23 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title IP Spoofing via X-Forwarded-For Header to Bypass Brute-Force Protection and Cause Denial of Service

Fri, 17 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Title Eclipse Kura IP Header Spoofing Allows Brute‑Force Bypass and Denial of Service

Thu, 16 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Title Eclipse Kura IP Header Spoofing Allows Brute‑Force Bypass and Denial of Service

Tue, 14 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse kura
Vendors & Products Eclipse
Eclipse kura

Tue, 14 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Description Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.
Weaknesses CWE-345
CWE-348
CWE-807
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Kura
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-07-14T12:22:02.042Z

Reserved: 2026-05-26T10:32:07.026Z

Link: CVE-2026-9561

cve-icon Vulnrichment

Updated: 2026-07-14T12:21:56.984Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T10:15:03Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity

  • CWE-348

    Use of Less Trusted Source

  • CWE-807

    Reliance on Untrusted Inputs in a Security Decision