CVE-2026-9561 Details

A vulnerability exists in Eclipse Kura versions prior to 5.6.2, where the application trusts the client-supplied X-Forwarded-For HTTP header as the definitive source of the client IP address for audit logs. This issue is present in the org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components, which rely on this header for initializing audit context. Additionally, the org.eclipse.kura.jetty.customizer component automatically applies Jetty's ForwardedRequestCustomizer to all HTTP and HTTPS connectors, allowing the HttpServletRequest.getRemoteAddr() method to return the attacker-controlled header value. An unauthenticated remote attacker can exploit this vulnerability to bypass IP-based brute-force defenses, such as fail2ban, by falsifying the logged IP address to a non-routable value, thus evading detection during a brute-force attack. Alternatively, the attacker could inject a victim's IP address to cause a denial-of-service by triggering a ban on that address.

Users can upgrade to Eclipse Kura version 5.6.2 or later, where this vulnerability has been addressed.