Quick answers
- Is CVE-2026-32662 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-32662 being exploited in the wild.
- How severe is CVE-2026-32662?
- Medium severity, with a CVSS score of 5.3, published 3 April 2026.
- Which products and versions are affected?
- Gardyn Cloud API before 2.12.2026.
- Is there a fix for CVE-2026-32662?
- A patch was published on 2026-02-24: Original vendor remediation date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-32662 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-32662?
- Check whether you run Gardyn Cloud API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Gardyn Cloud API, used for managing Gardyn Home and Studio devices, was found to have active debug code (CWE-489) in the form of development and test API endpoints. These endpoints remained accessible in the production environment and mirrored the functionality of production APIs. An unauthenticated remote attacker could leverage these endpoints to access sensitive information, including plant photos and limited demographic data (names, addresses, phone numbers, and email addresses). The vulnerability is addressed in Gardyn Cloud API versions 2.12.2026 and later.
Affected products
- Gardyn Cloud API before 2.12.2026
Timeline
- 2026-02-24: patched: Original vendor remediation date
- 2026-04-03: disclosed: Initial NVD publication
- 2026-04-03: advisory: ICS-CERT advisory published