CVE-2026-115216criticalCWE-295

CVE-2026-115216: fallo crítico en Eclipse ioFog

Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Eclipse ioFog

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.2%
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:N
Productos afectados
Eclipse Foundation · Eclipse ioFog
CVEs relacionadas — Eclipse ioFog

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-113619HIGHEclipse ioFog renders request templates before authenticationEPSS 0.4%CVE-2026-113620CRITICALEclipse ioFog operator WebSocket accepts an unverified JWTEPSS 0.3%CVE-2026-113644MEDIUMiofogctl command injection via Controller provisioning responseEPSS 0.2%