Eclipse ioFog Controller: Denial of Service via Unauthenticated Liquid Template Processing (CVE-2026-113619)

Eclipse ioFog Controller versions 3.8.0 through 3.9.1 contain a high-severity vulnerability (CVE-2026-113619) that permits unauthenticated denial-of-service (DoS) attacks. The flaw exists because the application utilizes the Liquid template engine to process request bodies for POST, PUT, and PATCH operations before enforcing authentication or role-based access control (RBAC).

The security controls in place fail to properly validate bearer tokens or apply rate limiting to these specific routes. By sending a specially crafted, small JSON body, an anonymous attacker can cause the controller process to stall or abort. The resulting disruption impacts the availability of the entire control plane, including agent APIs and in-process WebSocket relays, rendering the ioFog environment unresponsive. Defenders should prioritize patching or implementing network-level access controls to limit access to vulnerable controller endpoints.

Impact

Successful exploitation results in the loss of control plane availability, effectively disabling management of connected ioFog agents and WebSocket-based telemetry relays. This vulnerability poses a significant risk to distributed edge computing environments relying on ioFog, as the control plane serves as the central orchestration point for fleet operations.

Recommendation

• Upgrade Eclipse ioFog Controller to a version beyond 3.9.1 once a patch is available.
• Until patching is feasible, implement network-level access control lists (ACLs) to restrict access to the ioFog Controller API to authorized management IP addresses only.
• Enable web application firewall (WAF) or load balancer inspection to identify and block suspicious POST, PUT, and PATCH requests to the controller that contain excessive or malformed JSON payloads.