Eclipse Kura CVE-2026-97401

Exploitation requires ALL of: (1) the Kura command service is enabled - it is disabled by default since Kura 4.0.0, and the issue does not apply when it is disabled; (2) a packaged Kura installation where the JVM runs as kurad with CAP_DAC_OVERRIDE; (3) the operator has selected the 'Unprivileged' executor mode (privileged.command.service.enable=false, the default when the service is on); and (4) the attacker holds the rest.command permission (PR:L). Given these, the attacker sets workingDirectory to / and supplies a ZIP body to CommandCloudApp.execute() to write/overwrite arbitrary files as kurad. LIMITING FACTORS: non-default enablement of the command service, required rest.command authorization, and a packaged installation with the kurad CAP_DAC_OVERRIDE privilege model - all of which substantially narrow real-world exposure below what the base score alone suggests.

This is a genuine but conditional privilege/sandbox-escape issue rather than a mass-exploitation threat. The Eclipse-assigned CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) describes a network-reachable flaw requiring low privileges - specifically a caller already holding the rest.command permission - so it is not an unauthenticated remote code path. No EPSS score, no CISA KEV listing, and no public exploit were supplied, so exploitation is not confirmed in the wild. The vuln.today decision label is this_week, signaling a prompt-but-not-emergency priority, which is consistent with the absence of KEV/EPSS/POC signals. The real risk is tightly gated by configuration: the command service is disabled by default (since Kura 4.0.0), so default installations are not exposed; exposure requires the operator to have deliberately enabled the command service while intentionally restricting the caller to the unprivileged executor. One nuance worth flagging: the input Tags call this an 'Authentication Bypass,' but the description makes clear the attacker is already authenticated/authorized for rest.command and is escaping the *unprivileged executor sandbox* - this is a privilege-boundary bypass (CWE-73, external control of file path), not an authentication bypass. Impact is high integrity/availability because arbitrary files can be written as kurad (which holds CAP_DAC_OVERRIDE), with lower confidentiality impact (VC:L).

An operator enables the Kura command service but intentionally restricts a REST caller to unprivileged execution (privileged.command.service.enable=false). That caller, holding rest.command, sends a request to CommandCloudApp.execute() with workingDirectory=/ and a crafted ZIP archive; Kura extracts the archive as the kurad JVM process (which has CAP_DAC_OVERRIDE) before dropping to the kura user, writing or overwriting arbitrary files on the device and bypassing the sandbox the operator selected. No public exploit identified at time of analysis, so this reflects the described mechanism rather than an observed tool.