Eclipse ioFog vulnerabilities

3 known vulnerabilities in Eclipse ioFog from Eclipse Foundation. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Eclipse ioFog: Improper Certificate Validation

  CVE-2026-115216Oct 27, 2026Eclipse Foundation

  In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth cli

• 9.8 Critical severity

  Eclipse ioFog: Improper Verification of Cryptographic Signature

  CVE-2026-113620Oct 20, 2026Eclipse Foundation

  In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain ad

• 7.5 High severity

  Eclipse ioFog: Uncontrolled Resource Consumption

  CVE-2026-113619Oct 20, 2026Eclipse Foundation

  In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid to