CVE-2026-9561

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Description
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.

Analysis

AI-generated

Technical impact

Eclipse Kura components trust the client‑supplied X‑Forwarded‑For HTTP header as the definitive client IP address for audit log entries. The Web Console and REST API use this header when initializing audit context, and Jetty’s ForwardedRequestCustomizer unconditionally installs on all HTTP/HTTPS connectors, causing the request’s remote address to reflect the attacker‑controlled header value. An unauthenticated remote attacker can therefore send requests with a forged X‑Forwarded‑For header to make the system believe the source IP is a non‑routable value or a victim’s IP, bypassing IP‑based brute‑force protections such as fail2ban or causing a denial of service by triggering a ban on a legitimate IP.

Affected Systems

The Eclipse Foundation’s, specifically the org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components in all releases prior to version 5.6.2.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.8, indicating a high severity threat. The EPSS score of less than 1% suggests a low current probability of exploitation, and it is not listed in CISA’s KEV catalog. Attackers can exploit it X‑Forwarded‑For header; no authentication is required, making the attack path straightforward for anyone with network access to the Kura appliance.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Eclipse Kura to version 5.6.2 or later, which removes the trust in the X‑Forwarded‑For header for audit logging.
  • If an upgrade cannot be performed immediately, reconfigure Jetty to exclude ForwardedRequestCustomizer or modify the web console and REST API to ignore the X‑Forwarded‑For header when initializing audit context.
  • Deploy additional network filtering or a reverse proxy that strips or validates the X‑Forwarded‑For header, and enforce IP‑based rate‑limiting or fail2ban based on the true source IP address rather than the header value.

Generated by OpenCVE AI on August 1, 2026 at 10:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:eclipse:kura:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'}
Type Values Removed Values Added
Title X-Forwarded-For Header Spoofing Enables IP-Based Brute-Force and Denial of Service in Eclipse Kura
Type Values Removed Values Added
Title X-Forwarded-For Header Spoofing Enables IP-Based Brute-Force and Denial of Service in Eclipse Kura
Type Values Removed Values Added
Title IP Spoofing via X-Forwarded-For Header to Bypass Brute-Force Protection and Cause Denial of Service
Type Values Removed Values Added
Title IP Spoofing via X-Forwarded-For Header to Bypass Brute-Force Protection and Cause Denial of Service
Type Values Removed Values Added
Title Eclipse Kura IP Header Spoofing Allows Brute‑Force Bypass and Denial of Service
Type Values Removed Values Added
Title Eclipse Kura IP Header Spoofing Allows Brute‑Force Bypass and Denial of Service
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Eclipse
Eclipse kura
Vendors & Products Eclipse
Eclipse kura
Type Values Removed Values Added
Description Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializing audit context, and org.eclipse.kura.jetty.customizer unconditionally installs Jetty's ForwardedRequestCustomizer on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force protections — such as fail2ban — by spoofing the logged IP address to a non-routable value, allowing a brute-force attack to proceed undetected, or to cause a denial of service against a third party by injecting a victim's IP address and triggering a ban on that address.
Weaknesses CWE-345
CWE-348
CWE-807
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}
Earlier changes (5)
Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity

  • CWE-348

    Use of Less Trusted Source

  • CWE-807

    Reliance on Untrusted Inputs in a Security Decision

Sources

Status
PUBLISHED
Assigner
eclipse
Published
Updated
Jul 14, 2026, 12:22 PM
Reserved
May 26, 2026, 10:32 AM

View source JSON

Updated
Jul 14, 2026, 12:21 PM

JSON

Status
Analyzed
Published
Jul 14, 2026, 9:16 AM
Modified
Oct 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Aug 1, 2026, 10:15 AM

JSON