Gardyn IoT Hub Flaw CVE-2026-13768 (CVSS 10) Enables Unauthenticated Remote Code Execution

TL;DR

CISA published an advisory for three flaws in the Gardyn IoT Hub, the controller for Gardyn’s indoor smart gardens. The worst, CVE-2026-13768, earns a maximum CVSS score of 10 and allows unauthenticated remote code execution. Gardyn has already patched its cloud infrastructure, and devices update over the internet.

Why It Matters

Gardyn sells app-controlled hydroponic gardens for the home. A related CISA advisory counted more than 138,000 registered devices across the product line. So one exposed key puts a large fleet at risk. Because the flaw needs no login, an attacker could reach devices straight from the internet. One key would then unlock the whole managed fleet at once. CISA files these bugs under Food and Agriculture, a critical infrastructure sector. To date, CISA reports no known exploitation in the wild.

How the Attack Works

The Gardyn IoT Hub exposes a privileged iothubowner key. With that key, an attacker can call an Azure IoT Hub Registry Manager function. The call returns connection details for every Gardyn Home Kit and Studio device. From there, the attacker can run arbitrary commands on a chosen device. Worse, they can pivot to other devices on the victim’s home network. The CISA advisory ICSA-26-183-03 traces the root cause to hard-coded credentials, or CWE-798.

Two lesser bugs

CVE-2026-55726 (CVSS 5.3) leaves a device-log storage container publicly listable. CVE-2026-54477 (CVSS 5.4) drops security headers on the admin panel, which invites clickjacking and cross-site scripting.

Affected Versions

The flaws affect Gardyn Home and Studio firmware before master.627, plus Cloud API before 2.12.2026. Michael Groberman reported the issues to CISA.

Patch and Mitigation

Gardyn says its deployed infrastructure now blocks these flaws. Keep each Gardyn IoT Hub online so firmware updates arrive automatically. Also update the Gardyn mobile app to the latest version. Beyond that, CISA urges owners to keep control devices off the public internet and behind a firewall. For details and contacts, see the Gardyn security page.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.