CVE-2026-55726— Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Gardyn | Gardyn Cloud API | < 2.12.2026 | affected |
| Gardyn | Gardyn Home Firmware | < master.627 | affected |
| Gardyn | Gardyn Studio Firmware | < master.627 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55726
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
将系统数据暴露到未授权控制的范围
Source: NVD (National Vulnerability Database)
Vulnerability Title
Gardyn Home Firmware 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gardyn Home Firmware是美国Gardyn公司的一个智能室内水培种植设备的固件。 Gardyn Home Firmware master.627之前版本、Gardyn Studio Firmware master.627之前版本和Gardyn Cloud API 2.12.2026之前版本存在信息泄露漏洞，该漏洞源于Azure Blob Storage容器未经验证即可公开列出，可能导致恶意用户访问设备日志文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Gardyn | Gardyn Home Firmware | 0 ~ master.627 | - | |
| Gardyn | Gardyn Studio Firmware | 0 ~ master.627 | - | |
| Gardyn | Gardyn Cloud API | 0 ~ 2.12.2026 | - |
II. Public POCs for CVE-2026-55726
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55726
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55726 (2)
Same Patch Batch · Gardyn · 2026-07-02 · 3 CVEs total
| CVE-2026-13768 | 10.0 CRITICAL | Gardyn IoT Hub Use of Hard-coded Credentials |
| CVE-2026-54477 | 5.4 MEDIUM | Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax |
IV. Related Vulnerabilities
Same vendor: Gardyn
- CVE-2026-54477
Gardyn IoT Hub Improper Neutralization of HTTP Headers for S - CVE-2026-13768
Gardyn IoT Hub Use of Hard-coded Credentials - CVE-2025-10681
Gardyn Mobile Application and Device Firmware Use Hard-coded - CVE-2026-25197
Gardyn Cloud API Authorization Bypass Through User-Controlle - CVE-2026-28766
Gardyn Cloud API Missing Authentication for Critical Functio
Same weakness: CWE-497
- CVE-2026-50294
Windows Kernel Information Disclosure Vulnerability - CVE-2026-61977
WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Expos - CVE-2026-61976
WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitiv - CVE-2026-61975
WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposu - CVE-2026-57393
WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 -
V. Comments for CVE-2026-55726
No comments yet