Executive brief
Eclipse KUKSA Databroker, a component used for managing vehicle data in automotive software, contains a flaw in how it handles certain data update requests. An authorized user can send a specifically crafted message that causes a portion of the service to crash. While the entire system does not shut down, it can lead to failed data transmissions and minor service disruptions.
Technical details
The vulnerability is an improper input validation issue (CWE-20) within the `kuksa.val.v2.VAL/PublishValue` gRPC handler of Eclipse KUKSA Databroker. The server implementation calls `unwrap()` on the optional `data_point` field in a `PublishValueRequest` without first verifying its presence. If a request includes a valid `signal_id` but omits the `data_point`, the resulting panic in the Tokio worker thread causes the specific gRPC call to fail. Exploitation requires the attacker to possess a valid JWT token; unauthenticated requests are blocked before reaching the vulnerable code path. While the individual thread panics, the main Databroker process remains operational.
Affected products
- Eclipse Foundation KUKSA Databroker 0.6.1
Timeline
- 2026-07-14: advisory: NVD and Eclipse Foundation published the advisory.