Is CVE-2026-55726 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55726 being exploited in the wild.

How severe is CVE-2026-55726?

Medium severity, with a CVSS score of 5.3, published 3 July 2026.

Which products and versions are affected?

Gardyn Cloud API before 2.12.2026; Gardyn Home Firmware before master.627; Gardyn Studio Firmware before master.627.

Is there a fix for CVE-2026-55726?

A patch was published on 2026-02-24: Original remediation date reported by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55726 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55726?

Check whether you run Gardyn Cloud API, Gardyn Home Firmware or Gardyn Studio Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55726: Gardyn IoT Hub sensitive information exposure in Azure Blob Storage logs

CVE-2026-55726 · Severity: medium · CVSS 5.3 · Published 2026-07-03

Gardyn smart home gardening systems were found to have a security flaw where device logs were stored in a publicly accessible cloud storage container. This allowed anyone on the internet to view and list device log files without needing a password or account. While these logs primarily contain technical data, their exposure could lead to the disclosure of sensitive system information or device activity details.

Technologies: Gardyn Cloud API, Gardyn Home Firmware, Gardyn Studio Firmware. Vendors: Gardyn.

Quick answers

Is CVE-2026-55726 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55726 being exploited in the wild.
How severe is CVE-2026-55726?: Medium severity, with a CVSS score of 5.3, published 3 July 2026.
Which products and versions are affected?: Gardyn Cloud API before 2.12.2026; Gardyn Home Firmware before master.627; Gardyn Studio Firmware before master.627.
Is there a fix for CVE-2026-55726?: A patch was published on 2026-02-24: Original remediation date reported by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55726 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55726?: Check whether you run Gardyn Cloud API, Gardyn Home Firmware or Gardyn Studio Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an exposure of sensitive information (CWE-497) due to improper access control on an Azure Blob Storage container. The container used for storing Gardyn device logs was configured to allow public listing, enabling any unauthenticated network-based attacker to enumerate and download log files. This could result in the exposure of system metadata and device-specific operational data. The issue has been remediated through server-side infrastructure updates to the Gardyn Cloud API and automatic firmware updates for Gardyn Home and Studio devices.

Affected products

Gardyn Gardyn Home Firmware before master.627
Gardyn Gardyn Studio Firmware before master.627
Gardyn Gardyn Cloud API before 2.12.2026

Timeline

2026-02-24: patched: Original remediation date reported by vendor
2026-07-02: advisory: CISA ICSA-26-183-03 published
2026-07-03: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.