CVE-2026-113619

HighCVSS 7.5

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes enabling template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process.

Risk Assessment

An anonymous attacker can cause availability loss of the control plane, including the agent API and in-process WebSocket relays. No data exfiltration occurs, but service availability is impacted.

Recommendation

Upgrade Eclipse ioFog Controller to a version later than 3.9.1 if available, or apply vendor fixes. Until then, restrict network access to Controller routes and monitor for unusual requests.

Other vulnerabilities in Eclipse ioFog Controller

CVE-2026-113620Critical
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding.

Original NVD description (English source)

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS