What’s Vulnerable › Vulnerabilities

CVE-2026-115216: Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials

• Severity: critical (CVSS 9.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-27 · updated 2026-10-27
• Weakness: CWE-295

Description

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.

Summary

Eclipse ioFog Operator versions 3.8.0 before 3.9.2 disable TLS certificate verification when contacting the Controller API and when logging in to an external OIDC issuer. An on-path attacker can present any certificate to capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and can supply the access token the operator stores for later Controller API calls. CVSS is 9.1 (critical); it is not in CISA KEV and no exploitation is reported. Upgrade to 3.9.2 to fix.

تُعطّل إصدارات Eclipse ioFog Operator من 3.8.0 وحتى ما قبل 3.9.2 التحقق من شهادة TLS عند الاتصال بواجهة Controller API وعند تسجيل الدخول إلى مزوّد OIDC خارجي. يمكن لمهاجم على المسار تقديم أي شهادة لالتقاط سر عميل OAuth (الوضع الخارجي) أو كلمة مرور المسؤول الأولية لـ Controller (الوضع المضمّن مع تفعيل HTTPS في Controller)، كما يمكنه تزويد رمز الوصول الذي يخزّنه المشغّل لاستخدامه لاحقًا في استدعاءات Controller API. درجة CVSS هي 9.1 (حرجة)، ولا توجد في CISA KEV ولم يُبلَّغ عن استغلال. الترقية إلى 3.9.2 تعالج المشكلة.

Affected products

• Eclipse Foundation Eclipse ioFog: from 3.8.0 before 3.9.2 — fixed in 3.9.2

How to fix

Upgrade to a fixed version: Eclipse Foundation Eclipse ioFog 3.9.2. Check the vendor advisory for mitigations.

References

• https://github.com/eclipse-iofog/iofog-operator/releases/tag/v3.9.2
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/519
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1064

Get alerted when CVE-2026-115216 or the next vulnerability affects your stack