CVE-2026-113620

CriticalCVSS 9.8

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

Risk Assessment

An attacker can open an exec or log session for a microservice or fog whose UUID they know, potentially leading to command execution or data disclosure. This is a serious risk to cluster security.

Recommendation

Update Eclipse ioFog Controller to a patched version and ensure JWT verification on WebSocket routes.

Other vulnerabilities in Eclipse ioFog Controller

CVE-2026-113619High
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes enabling template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process.

Original NVD description (English source)

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS