CVE-2026-115216
CriticalCVSS 9.1Summary
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret or the Controller bootstrap admin password, and supply the access token the operator stores for later Controller API calls.
Risk Assessment
Captured credentials may allow an attacker to impersonate and access the Controller API. This is a serious risk to the confidentiality and integrity of the managed infrastructure.
Recommendation
Upgrade Eclipse ioFog Operator to version 3.9.2 or later. Until then, limit network trust and monitor for unusual connections.
Related vulnerabilities
- CVE-2026-65145Critical
NVIDIA NeMo Agent Toolkit contains a missing authentication vulnerability that an attacker could exploit. This may lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure.
- CVE-2026-112362Critical
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path.
- CVE-2026-117532Critical
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.
- CVE-2026-86577Critical
Out-of-bounds write vulnerability in Hitachi JP1 products. It affects JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, Agent Minimal Edition), and JP1/Base in specific versions. The flaw can cause memory corruption due to writing beyond buffer boundaries.
- CVE-2026-86576Critical
Heap-based buffer overflow vulnerability in Hitachi JP1 products. It affects JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, Agent Minimal Edition), and JP1/Base in specified version ranges. The flaw can corrupt heap memory.
- CVE-2026-86575Critical
Stack-based buffer overflow vulnerability in Hitachi JP1 products. It affects JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, Agent Minimal Edition), and JP1/Base in specific versions. The flaw can corrupt stack memory and potentially lead to code execution.
- CVE-2026-86574Critical
Heap-based buffer overflow vulnerability in Hitachi JP1/Base. It affects versions from 11-00 before 12-50-54. The flaw can corrupt heap memory.
- CVE-2026-82122Critical
Stack-based buffer overflow vulnerability in Hitachi HiRDB. It affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and HiRDB Server Version 9 and additional-function variants in specified version ranges. The flaw can corrupt stack memory.
- CVE-2026-82120Critical
Heap-based buffer overflow vulnerability in Hitachi HiRDB. It affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and HiRDB Server Version 9 and additional-function variants in specified version ranges. The flaw can corrupt heap memory.
- CVE-2026-82119Critical
OS command injection vulnerability in Hitachi HiRDB. It affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and HiRDB Server Version 9 and additional-function variants in specified version ranges. The flaw may allow execution of arbitrary commands on the system.
Original NVD description (English source)
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS