CVE-2026-71278: rust-iot-platform RCE Vulnerability

CVE-2026-71278 Overview

CVE-2026-71278 is an unauthenticated remote code execution vulnerability in the rust-iot-platform project. The flaw resides in the calc rule creation endpoint, which accepts a user-controlled JavaScript script field and executes it server-side without sandboxing. The route POST /calc-rule/create in api/src/controller/calc_rule_router.rs omits the AuthToken request guard applied to other endpoints. As a result, any network-reachable attacker can create and trigger a malicious calc rule to execute arbitrary JavaScript in the server process. The vulnerability maps to CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the server process, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

rust-iot-platform (open-source IoT platform maintained by iot-ecology)
Deployments exposing the api service /calc-rule/create endpoint
Instances using quick_js::Context::eval() for calc rule execution

Discovery Timeline

2026-08-05 - CVE-2026-71278 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71278

Vulnerability Analysis

The rust-iot-platform API exposes a calc rule creation route intended to let operators define computation logic for incoming IoT telemetry. Rules are persisted with a script field containing JavaScript source code. When a rule is triggered, the backend passes the stored script directly to quick_js::Context::eval() inside api/src/biz/calc_run_biz.rs. The QuickJS runtime is embedded without a sandbox, resource limits, or capability restrictions, so evaluated code runs with the full privileges of the server process. Because the create endpoint does not apply the application's AuthToken request guard, an attacker requires no credentials to seed a malicious rule.

Root Cause

Two defects combine to produce the vulnerability. First, the calc rule creation route is missing the authentication guard used on comparable endpoints, exposing a state-changing operation to anonymous callers. Second, the platform treats user-supplied JavaScript as trusted input and hands it to an unrestricted interpreter. Neither validation, allowlisting, nor process isolation is applied before evaluation.

Attack Vector

An attacker sends an HTTP POST to /calc-rule/create on a reachable instance, supplying a JSON body whose script field contains attacker-controlled JavaScript. The rule is stored, then executed the next time the calc engine processes it. The script executes inside the api server process with access to whatever host resources that process has, including outbound network access, filesystem operations exposed through QuickJS bindings, and any host functions registered with the runtime.

No verified proof-of-concept code is published in the referenced advisory. Refer to the GitHub IoT Platform Repository for source-level detail on the vulnerable handler and evaluator.

Detection Methods for CVE-2026-71278

Indicators of Compromise

Unauthenticated POST requests to /calc-rule/create originating from unexpected source addresses
Newly created calc rules whose script fields contain network, filesystem, or process-related JavaScript constructs
Outbound connections from the api service process to unfamiliar hosts shortly after calc rule creation or trigger events

Detection Strategies

Inspect application logs for POST /calc-rule/create calls lacking a valid session or bearer token
Audit the calc rule database table for script values containing suspicious identifiers such as shell invocations, base64 blobs, or HTTP client calls
Correlate calc rule create events with subsequent quick_js::Context::eval() execution and anomalous child process or socket activity

Monitoring Recommendations

Enable request-level logging on the API service, capturing method, path, source IP, and authentication state
Alert on any write operation to calc rule storage that is not preceded by an authenticated session
Baseline expected outbound connections from the api process and alert on deviations

How to Mitigate CVE-2026-71278

Immediate Actions Required

Restrict network exposure of the rust-iot-platform API to trusted management networks until a fix is deployed
Add the AuthToken request guard to the calc rule creation route and any other unguarded state-changing endpoints
Review existing calc rules and remove any whose script content cannot be attributed to a known operator

Patch Information

At the time of publication, no vendor advisory URL or fixed release is listed in the NVD entry. Track upstream commits and issues at the GitHub IoT Platform Repository for a corrected build.

Workarounds

Place the API behind a reverse proxy that requires authentication before requests reach /calc-rule/create
Disable or remove the calc rule feature by commenting out the route registration in calc_rule_router.rs if it is not required
Replace quick_js::Context::eval() execution with a constrained expression evaluator or run the interpreter inside a sandboxed subprocess with limited privileges

bash

# Example reverse-proxy rule blocking unauthenticated access to the vulnerable route
# nginx configuration snippet
location = /calc-rule/create {
    auth_request /_internal_auth;
    proxy_pass http://rust_iot_backend;
}