CVE-2026-115216 Details
Description
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
A vulnerability exists in Eclipse ioFog Operator versions 3.8.0 prior to 3.9.2, where TLS certificate verification is disabled when the operator interacts with the Controller API and during login to an external OIDC issuer. This flaw allows an on-path attacker to present any certificate, potentially intercepting the OAuth client secret (in external mode) or the Controller bootstrap admin password (in embedded mode with Controller HTTPS enabled). The attacker could then misuse the access token that the operator retains for subsequent Controller API interactions. Notably, version 3.8 removed Keycloak integration, and the compromised credential is not a Keycloak realm-admin secret.
Users can upgrade to Eclipse ioFog Operator version 3.9.2 or later, which restores proper TLS certificate verification for Controller and external OIDC connections. The update is available through the Eclipse ioFog GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1064 | CISA-ADP | Issue TrackingPermission RequiredVendor |
| https://github.com/eclipse-iofog/iofog-operator/releases/tag/v3.9.2 | [email protected] | Release NotesVendor |
| https://gitlab.eclipse.org/security/cve-assignment/-/work_items/519 | [email protected] | AdvisoryRemedyVendor |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1064 | [email protected] | Issue TrackingPermission RequiredVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse ioFog Operator | >= 3.8.0, < 3.9.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |