{"id":"CVE-2026-71278","published":"2026-08-05T13:24:52.320","lastModified":"2026-08-10T12:17:30.310","description":"rust-iot-platform allows creating a \"calc rule\" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/iot-ecology/rust-iot-platform","tags":[]}],"exploitRefs":[{"url":"https://github.com/iot-ecology/rust-iot-platform","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows creating a 'calc rule' without authentication, enabling unauthorized access and potential manipulation of critical data.","exploitability":"Exploitation is relatively easy as no authentication is required to create a 'calc rule'. Precondition: Access to the POST /calc-rule/create endpoint.","blast_radius":"If exploited, this could lead to significant data breaches or system compromises affecting the entire rust-iot-platform infrastructure.","remediation":"Implement proper authentication checks for the POST /calc-rule/create endpoint to prevent unauthorized access.","tags":["auth-bypass","rce","web","api"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:43:43.862Z"}}