CVE-2026-55726 Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere
Attackers can access sensitive device logs from the public Azure Blob Storage container without authentication, exposing system information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55726?
CVE-2026-55726 is a medium-severity vulnerability in Gardyn Cloud API, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.
Weakness: CWE-497
Which versions are affected by CVE-2026-55726?
How do I fix CVE-2026-55726?
No fix has been published for CVE-2026-55726 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-55726 being exploited?
There is no known exploitation of CVE-2026-55726 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-pfg9-vjvh-f5rw.