Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-113620: Eclipse ioFog allows unauthorized admin WebSocket access
CVE-2026-113620 · published 2 days ago
Summary
Versions 3.8.0 to 3.9.1 of the Eclipse ioFog controller let anyone craft a fake token that looks like an admin and connect through certain WebSocket links. This could let an attacker start or view microservice sessions if they already know the service’s identifier. Update to a patched version or apply the vendor’s recommended configuration to enforce proper token verification.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eclipse foundation | eclipse iofog | <= 3.9.1 |
Original advisory text
Eclipse ioFog operator WebSocket accepts an unverified JWT
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published20 Oct 2026
Updated22 Oct 2026
First seen20 Oct 2026
Track software like this
Free during beta