Is CVE-2026-112191 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112191 being exploited in the wild.

How severe is CVE-2026-112191?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Eclipse Kura 5.4.0 through 5.6.2.

Is there a fix for CVE-2026-112191?

Yes: fixed in Eclipse Kura 5.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112191 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-112191?

Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112191: Eclipse Kura Identity REST APIs privilege escalation

CVE-2026-112191 · Severity: info · Published 2026-11-10

Eclipse Kura is an IoT gateway framework that manages device identity and permissions through REST APIs. An attacker with a lower-privileged account can exploit missing authorization checks to escalate to full administrator privileges, lock out legitimate administrators, and gain complete control of the device.

Technologies: Eclipse Kura. Vendors: Eclipse.

Quick answers

Is CVE-2026-112191 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112191 being exploited in the wild.
How severe is CVE-2026-112191?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Eclipse Kura 5.4.0 through 5.6.2.
Is there a fix for CVE-2026-112191?: Yes: fixed in Eclipse Kura 5.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112191 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-112191?: Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Eclipse Kura 5.6.3

Technical details

The Identity REST APIs (identity/v1 and identity/v2) in Eclipse Kura fail to validate that permission management requests are authorized by the requester's own permissions. An authenticated user with the rest.identity permission but without kura.admin can assign any permission (including kura.admin) to themselves or other identities, modify passwords, delete other identities, and manage permissions, leading to privilege escalation. The vulnerability is an authorization bypass due to improper privilege management checks.

Affected products

Eclipse Kura 5.4.0 through 5.6.2

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.