External risk intelligence

Unauthenticated Arbitrary JavaScript Execution in rust-iot-platform Calc Rule API.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-71278

The vulnerability exists in a web API endpoint intended for creating IoT calculation rules. Because this endpoint is reachable without authentication and is exposed as a public-facing web service for IoT management, it is designed to be accessible, making it a highly reachable internet-facing surface.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the rust-iot-platform that allows unauthenticated users to execute arbitrary JavaScript on the server. The issue stems from an API endpoint that lacks proper authentication and sandboxing for a script execution feature. This could potentially lead to a compromise of the server's integrity and data.

Unauthenticated script execution in IoT platform.
Critical flaw risks server compromise.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach a vulnerable API endpoint without needing any credentials. By sending a crafted request with a malicious script to the `/calc-rule/create` endpoint, an unauthenticated attacker can trick the server into executing arbitrary JavaScript code. This can lead to a compromise of the server process.

No authentication required to access.
Sending a malicious script in a POST request.
Arbitrary JavaScript execution on the server.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could execute arbitrary JavaScript within the server process by creating a malicious calculation rule. This could affect the behavior of the service and potentially expose or manipulate system data when the rule is triggered.

Server process code execution.
Unauthenticated API access.
Malicious script execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation will likely involve application owners and potentially platform or infrastructure teams, depending on deployment. The first practical step is to identify all instances of the affected platform, determine their reachability and business criticality, and then confirm the accountable owner for each. Planning for remediation should be risk-based and coordinated with vendor engagement if necessary.

Confirm affected system ownership.
Verify external reachability and impact.
Plan vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is rust-iot-platform?

rust-iot-platform is a software framework built in Rust, designed to manage IoT devices and infrastructure. It includes features for processing data through custom calculation rules, which allow users to define automated logic for interpreting sensor or system data.

How does CVE-2026-71278 allow code execution?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). The platform exposes an API endpoint for creating calculation rules that fails to validate user identity or restrict the provided script. Because the underlying JavaScript engine executes these inputs without a sandbox, the server treats malicious user input as legitimate system commands.

Do I need to be logged in to trigger this bug?

No. The specific API route used to create calculation rules does not require an authentication token, unlike other parts of the application. Simply sending a crafted POST request to the endpoint is sufficient to store and trigger the malicious script; legitimate administrative credentials are not a prerequisite.

How do I know if my instance is at risk?

Halo Surface Signal identifies this as a highly reachable, internet-facing service because it is intended for IoT management. If your deployment of rust-iot-platform is accessible via the public internet to enable remote device management, it is likely exposed to this threat.

What should I do first to address this CVE?

Begin by auditing your infrastructure to locate all instances of rust-iot-platform. Determine whether these instances are exposed to the internet, assess their business criticality, and identify the team responsible for their maintenance to coordinate an urgent security review.

References

github.com/iot-ecology/rust-iot-platform

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.