CVE-2026-13699

Name of the Vulnerable Software and Affected Versions Eclipse KUKSA Databroker version 0.6.1

Description The kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data point field in PublishValueRequest. If a request includes a valid signal id but omits data point, the server executes the unwrap() function on request.data point, causing a panic in the Tokio worker thread. This condition can be triggered by any client possessing a valid JWT token. While the panic cancels the specific gRPC call, the Databroker process continues to run and remains available for other requests.

Recommendations As a temporary mitigation, restrict the use of the data point field in the kuksa.val.v2.VAL/PublishValue endpoint to ensure it is always provided when a signal id is present. At the moment, there is no information about a newer version that contains a fix for this vulnerability.