CVE-2026-113620
Eclipse ioFog operator WebSocket accepts an unverified JWT
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.
| CWE | CWE-347 |
| Vendor | eclipse foundation |
| Product | eclipse iofog |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for eclipse foundation eclipse iofog
Be the first to know when new critical vulnerabilities affecting eclipse foundation eclipse iofog are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Eclipse Foundation / Eclipse ioFog
3.8.0 ≤ 3.9.1
References
gitlab.eclipse.org: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1270 gitlab.eclipse.org: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1269 gitlab.eclipse.org: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1267 gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/468
Credits
Eclipse Foundation Security Team