CVE-2026-84736 Details
Description
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification. As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens. The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.
A vulnerability exists in the Eclipse aeriOS project, specifically within the Federator component, which disables TLS certificate validation for outbound HTTPS connections by default. This issue is present in the current development version, prior to any official release. When the TLS_CERTIFICATE_VALIDATION environment variable is not set or is set to false, the component's HTTP transport is configured to bypass TLS certificate verification. Consequently, an attacker intercepting network communications between the Federator and external services could impersonate those services and capture sensitive information transmitted over HTTPS, such as OAuth client credentials and bearer tokens. The vulnerability has been addressed by enabling TLS certificate validation by default, with the environment variable now set to true in the default configurations provided by the Helm chart and Docker Compose deployment.
Users can update their deployment configurations to set the TLS_CERTIFICATE_VALIDATION environment variable to true, ensuring that TLS certificate validation is enabled by default.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eclipse-aerios/federator/commit/9c63b60becc9873b0195ff9cd6582b69cb12d4f2 | [email protected] | Source CodeVendor |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/755 | [email protected] | Issue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse aeriOS | All versions |
CPE
Remediation
| |
| Eclipse aeriOS Federator | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |