Cpe:2.3:a:eclipse:iofog_controller:3.9.1:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aeclipseiofog_controller3.9.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 20 Oct 2026 14:17:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEclipse ioFog Controller: WebSocket Authentication Bypass (CVE-2026-113620)https://feed.craftedsignal.io/briefs/2026-10-iofog-auth-bypass/Tue, 20 Oct 2026 14:17:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-iofog-auth-bypass/Eclipse ioFog Controller versions 3.8.0 through 3.9.1 contain an authentication bypass vulnerability in operator WebSocket endpoints, allowing attackers to access exec and log sessions using self-minted bearer tokens.Eclipse ioFog Controller versions 3.8.0 through 3.9.1 are affected by an authentication bypass vulnerability (CVE-2026-113620) within the operator WebSocket implementation. Specifically, the exec and log routes fail to perform proper validation of the provided bearer JSON Web Token (JWT). The application decodes the token and incorrectly utilizes the groups or roles defined within the payload as RBAC subjects. An attacker can craft a self-minted token containing administrative groups to bypass authorization checks, as the system does not require an associated account or RoleBinding. This flaw allows unauthorized actors to initiate exec or log sessions for specific microservices or fog instances, provided the attacker has obtained the target's UUID. HTTP routes and Agent WebSockets correctly verify tokens and remain unaffected.

Impact

Successful exploitation allows unauthorized administrative access to container exec and log streams. This could lead to sensitive information disclosure via logs or full command execution on managed microservices and fog instances, potentially allowing an attacker to move laterally or exfiltrate data within the fog edge computing environment.

Recommendation

  • Patch the Eclipse ioFog Controller by upgrading to a version released after 3.9.1 that addresses CVE-2026-113620.
  • Audit access logs for WebSockets requests to the ioFog Controller that originate from unauthorized internal segments or external sources.
  • Monitor for unexpected exec or log session initiation for critical microservices or fog instances, especially those appearing with administrative role claims that do not correspond to known service identities.
]]>criticaladvisoryauthentication-bypassweb-application-vulnerabilitycloud-edgeEclipse ioFog Controller: Denial of Service via Unauthenticated Liquid Template Processing (CVE-2026-113619)https://feed.craftedsignal.io/briefs/2026-10-iofog-controller-dos/Tue, 20 Oct 2026 14:17:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-iofog-controller-dos/An unauthenticated denial-of-service vulnerability in Eclipse ioFog Controller (versions 3.8.0 through 3.9.1) allows attackers to crash the controller process by sending malicious JSON payloads to template-processing routes.Eclipse ioFog Controller versions 3.8.0 through 3.9.1 contain a high-severity vulnerability (CVE-2026-113619) that permits unauthenticated denial-of-service (DoS) attacks. The flaw exists because the application utilizes the Liquid template engine to process request bodies for POST, PUT, and PATCH operations before enforcing authentication or role-based access control (RBAC).

The security controls in place fail to properly validate bearer tokens or apply rate limiting to these specific routes. By sending a specially crafted, small JSON body, an anonymous attacker can cause the controller process to stall or abort. The resulting disruption impacts the availability of the entire control plane, including agent APIs and in-process WebSocket relays, rendering the ioFog environment unresponsive. Defenders should prioritize patching or implementing network-level access controls to limit access to vulnerable controller endpoints.

Impact

Successful exploitation results in the loss of control plane availability, effectively disabling management of connected ioFog agents and WebSocket-based telemetry relays. This vulnerability poses a significant risk to distributed edge computing environments relying on ioFog, as the control plane serves as the central orchestration point for fleet operations.

Recommendation

  • Upgrade Eclipse ioFog Controller to a version beyond 3.9.1 once a patch is available.
  • Until patching is feasible, implement network-level access control lists (ACLs) to restrict access to the ioFog Controller API to authorized management IP addresses only.
  • Enable web application firewall (WAF) or load balancer inspection to identify and block suspicious POST, PUT, and PATCH requests to the controller that contain excessive or malformed JSON payloads.
]]>lowadvisory