CVE-2026-13699 is an input validation vulnerability (CWE-20) in Eclipse KUKSA Databroker version 0.6.1. The vulnerability arises because the PublishValue gRPC handler does not validate the existence of the optional data_point field in PublishValueRequest messages. When a request with a valid signal_id omits data_point, the server calls unwrap() on the absent data_point, causing a panic in the Tokio worker thread. This results in the cancellation of the affected gRPC call but does not terminate the Databroker service. Exploitation requires a valid JWT token; unauthenticated or invalid-token requests are blocked before the vulnerable code is reached. No patch or official remediation is currently documented.

An attacker with a valid JWT token can cause a denial of service for individual gRPC calls by triggering a panic in the Tokio worker thread. The panic cancels only the specific gRPC call but does not crash or stop the Databroker process, which remains available for other requests. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to clients with valid JWT tokens and monitor for abnormal gRPC call cancellations. No official fix or workaround is documented at this time.