CVE-2026-13768: Gardyn IoT Hub Use of Hard-coded Credentials

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub2 Jul
5. Not established: not seen

DescriptionNVD

Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Hard-coded Credentials · Authentication

Vendor

Gardyn

Published

July 2026

Band

Unlikely (under 1%), July 2026

1. 2 Jul
   PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub

• NVD entrynvd.nist.gov
• Vendor advisorymygardyn.com
• CVE recordcve.org
• Weakness CWE-798cwe.mitre.org