CVE-2026-55726: Publicly Listable Azure Blob Storage Container (device logs)
Advisory
| Field | Value |
|---|
| CVE | CVE-2026-55726 |
| ICSA | ICSA-26-183-03 (Gardyn IoT Hub) |
| CVSS 3.1 | 5.3 (Medium) |
| Vector (3.1) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Vector (4.0) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CWE | CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) |
| Researcher | Michael Groberman |
| Published | 2026-07-02 |
| Coordinated finding | Gr0m-017 (public blob container device-log) |
Product
| Field | Value |
|---|
| Vendor | Gardyn |
| Product | Gardyn Home Kit, Gardyn Studio |
| Component | Cloud API / Azure Blob Storage (device-log container) |
| Affected Versions |
Summary
The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user can enumerate and read any device log file in the container. Logs were available from approximately May 2020 through disclosure (5+ years).
Vulnerability Details
The device-log container permits anonymous listing and object read. Exposed content includes:
Impact is information disclosure, device fingerprinting, and internal-network reconnaissance (SSID names and paths support targeting).
Mapping to coordinated findings
| Aspect | Detail |
|---|
| Gr0m-017 | Public blob container device-log, unauthenticated listing, logs from May 2020+ |
Per ICSA-26-183-03, Gardyn states the IoT Hub deployed infrastructure has been updated to address the listed vulnerabilities.
- Set the container access level to Private.
- Require SAS tokens (scoped, short-lived) for any required access.
- Audit existing objects; redact sensitive data (SSIDs, paths, credentials) from logs.
Researcher: Michael Groberman (Gr0m) · Case: CERT/CC VU#653116 · Advisory: ICSA-26-183-03
michaeladamgroberman/cve-2026-55726
