Gardyn Cloud API Missing Authentication for Critical Function

The impact of CVE-2026-32646 is significant due to the potential for unauthorized control over Gardyn devices. An attacker exploiting this vulnerability could remotely manage devices, potentially altering settings, accessing sensitive data stored on the devices, or even disrupting their operation. This could lead to privacy breaches, operational disruptions, and potential physical harm if the devices are involved in critical processes. The lack of authentication effectively eliminates a key security barrier, making the API highly susceptible to malicious actors.

Gardyn users and organizations relying on the Gardyn Cloud API for device management are at risk. This includes both individual consumers and commercial deployments of Gardyn devices. Systems with older, unpatched versions of the API are particularly vulnerable.

1. 2026-04-03Disclosure

   disclosure

1. Reservado2026-03-17
2. Publicada2026-04-03
3. Modificada2026-04-07
4. EPSS actualizado2026-04-11

The primary mitigation for CVE-2026-32646 is to immediately upgrade the Gardyn Cloud API to version 2.12.2026 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the administrative endpoint using a firewall or Web Application Firewall (WAF). Specifically, block access from any IP address that is not explicitly authorized. Monitor API logs for unusual activity, particularly requests to the administrative endpoint originating from unexpected sources. After upgrading, confirm the vulnerability is resolved by attempting to access the administrative endpoint without authentication; access should be denied.