Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-84736: Eclipse aeriOS Federator skips HTTPS certificate checks
CVE-2026-84736 · published 2 months ago
Summary
The Federator part of the Eclipse aeriOS development build does not verify HTTPS certificates by default, allowing anyone who can watch the network to pretend to be the intended service. This could let attackers capture passwords, tokens, and other private data sent over secure connections. Update to the latest version or adjust the configuration so that TLS certificate validation is turned on.
What to do
- Update eclipse foundation eclipse aerios to version 9c63b60becc9873b0195ff9cd6582b69cb12d4f2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eclipse foundation | eclipse aerios | < 9c63b60becc9873b0195ff9cd6582b69cb12d4f2 |
Original advisory text
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connection...
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification.
As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens.
The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.
As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens.
The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84736... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84736 Vendor Advisory
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/755 URL
- https://github.com/eclipse-aerios/federator/commit/9c63b60becc9873b0195ff9cd6582... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.6
High
Type
CWE-295Improper Certificate Validation
Timeline
Published3 Sep 2026
Updated3 Nov 2026
First seen3 Sep 2026
Track software like this
Free during beta