9.1
Critical
CVE-2026-115216 Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
Description
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:NExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- Interaction
- None
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
- Confidentiality of other systems
- High
- Integrity of other systems
- High
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse ioFog 3.8 | 3.8.0 → < 3.9.2 | 3.9.2 |
Other CVEs of Eclipse ioFog
The 4 CVEs of Eclipse ioFog →
CVE-2026-113644
iofogctl command injection via Controller provisioning response
5.5
Medium
CVE-2026-113620
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do…
9.8
Critical
CVE-2026-113619
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template…
7.5
High