Eclipse Kura CVE-2026-97891

No special conditions beyond network reachability to the Kura Web Console: the flaw is triggered by any unauthenticated client sending requests to the built-in authentication endpoints (/admin/auth, /admin/login/password, /admin/login/cert) while not honoring the returned session cookie, on default configurations of Eclipse Kura 5.0.0 through 5.6.2. Session allocation happens before method checking, request parsing, or credential validation, so no valid credentials, specific HTTP method, or non-default feature toggle is needed. The practical limiting factor is exposure: the attacker must be able to reach the Web Console administrative interface, so gateways whose console is bound to a trusted/management network or firewalled from untrusted clients are substantially less exposed. No authentication and no user interaction are required (PR:N/UI:N).

This is a genuine but bounded-impact priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated attack with no user interaction - the mechanics are fully exposed: an unauthenticated client simply refuses to honor the returned session cookie and repeats requests to /admin/auth, /admin/login/password, or /admin/login/cert, each of which allocates a fresh HTTP session before any method check, parsing, or credential validation (CWE-770). Impact is overwhelmingly availability: the input vector rates VA:H (process crash via JVM heap exhaustion) with only VI:L/SI:L and no confidentiality impact, so this is a denial-of-service issue, not a path to code execution or data theft - the headline 8.8 is driven by the availability crash, not by broad CIA compromise. I regard the VI:L/SI:L integrity sub-scores as weakly justified for what the description presents as pure resource exhaustion; a clean read of the mechanism supports availability-only impact. On the decision signals: vuln.today assigns 'this_week' (not act_now/emergency), it is NOT in CISA KEV, no EPSS score is supplied, and no proof-of-concept or exploit code is referenced - the two references are the Eclipse GHSA advisory and the Eclipse CVE-assignment work item. So the real-world picture is a trivially-exploitable DoS against a niche IoT-gateway product with no evidence of active exploitation and unknown exploitation probability (EPSS missing). Priority is real for anyone exposing the Kura Web Console to untrusted networks, but it is a 'patch this week' availability bug, not a widespread weaponized threat.

An unauthenticated attacker with network reachability to the Kura Web Console repeatedly POSTs (or sends any request) to /admin/auth, /admin/login/password, or /admin/login/cert while deliberately discarding the Set-Cookie session identifier each time. Because the server allocates a new HTTP session before checking the method, parsing the body, or validating credentials, each request consumes heap until the JVM runs out of memory and the Kura process crashes, taking the gateway offline. No public exploit is referenced, but the attack requires nothing more than a scripted HTTP flood that ignores cookies.