# CVE-2026-55726: Gardyn IoT Hub sensitive information exposure in Azure Blob Storage logs

Source: https://junglewise.ai/threats/cve-2026-55726-gardyn-iot-hub-sensitive-information-exposure-in-azure-blob  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-55726 · Severity: medium · CVSS 5.3 · Published 2026-07-03

Gardyn smart home gardening systems were found to have a security flaw where device logs were stored in a publicly accessible cloud storage container. This allowed anyone on the internet to view and list device log files without needing a password or account. While these logs primarily contain technical data, their exposure could lead to the disclosure of sensitive system information or device activity details.

Technologies: [Gardyn Cloud API](https://junglewise.ai/threats/technologies/cloud-api), [Gardyn Home Firmware](https://junglewise.ai/threats/technologies/home-firmware), [Gardyn Studio Firmware](https://junglewise.ai/threats/technologies/studio-firmware). Vendors: [Gardyn](https://junglewise.ai/threats/vendors/gardyn).

## Quick answers

**Is CVE-2026-55726 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55726 being exploited in the wild.

**How severe is CVE-2026-55726?** Medium severity, with a CVSS score of 5.3, published 3 July 2026.

**Which products and versions are affected?** Gardyn Cloud API before 2.12.2026; Gardyn Home Firmware before master.627; Gardyn Studio Firmware before master.627.

**Is there a fix for CVE-2026-55726?** A patch was published on 2026-02-24: Original remediation date reported by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55726 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55726?** Check whether you run Gardyn Cloud API, Gardyn Home Firmware or Gardyn Studio Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as an exposure of sensitive information (CWE-497) due to improper access control on an Azure Blob Storage container. The container used for storing Gardyn device logs was configured to allow public listing, enabling any unauthenticated network-based attacker to enumerate and download log files. This could result in the exposure of system metadata and device-specific operational data. The issue has been remediated through server-side infrastructure updates to the Gardyn Cloud API and automatic firmware updates for Gardyn Home and Studio devices.

## Affected products

- Gardyn Gardyn Home Firmware before master.627
- Gardyn Gardyn Studio Firmware before master.627
- Gardyn Gardyn Cloud API before 2.12.2026

## Timeline

- 2026-02-24: patched: Original remediation date reported by vendor
- 2026-07-02: advisory: CISA ICSA-26-183-03 published
- 2026-07-03: disclosed: NVD publication date

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-03.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-03.json)
- [https://mygardyn.com/security/](https://mygardyn.com/security/)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03](https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03)

## Related threats

- [Gardyn IoT Hub missing security headers in admin panel](https://junglewise.ai/threats/cve-2026-54477-gardyn-iot-hub-missing-security-headers-in-admin-panel)
- [Gardyn IoT Hub hard-coded privileged key exposure](https://junglewise.ai/threats/cve-2026-13768-gardyn-iot-hub-hard-coded-privileged-key-exposure)