{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/iofog-controller-3.8.0-through-3.9.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:eclipse:iofog_controller:3.8.0:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:iofog_controller:3.9.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-113620"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-113620\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["ioFog Controller (3.8.0 through 3.9.1)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","web-application-vulnerability","cloud-edge"],"_cs_type":"advisory","_cs_vendors":["Eclipse"],"content_html":"\u003cp\u003eEclipse ioFog Controller versions 3.8.0 through 3.9.1 are affected by an authentication bypass vulnerability (CVE-2026-113620) within the operator WebSocket implementation. Specifically, the exec and log routes fail to perform proper validation of the provided bearer JSON Web Token (JWT). The application decodes the token and incorrectly utilizes the groups or roles defined within the payload as RBAC subjects. An attacker can craft a self-minted token containing administrative groups to bypass authorization checks, as the system does not require an associated account or RoleBinding. This flaw allows unauthorized actors to initiate exec or log sessions for specific microservices or fog instances, provided the attacker has obtained the target's UUID. HTTP routes and Agent WebSockets correctly verify tokens and remain unaffected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized administrative access to container exec and log streams. This could lead to sensitive information disclosure via logs or full command execution on managed microservices and fog instances, potentially allowing an attacker to move laterally or exfiltrate data within the fog edge computing environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the Eclipse ioFog Controller by upgrading to a version released after 3.9.1 that addresses CVE-2026-113620.\u003c/li\u003e\n\u003cli\u003eAudit access logs for WebSockets requests to the ioFog Controller that originate from unauthorized internal segments or external sources.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected exec or log session initiation for critical microservices or fog instances, especially those appearing with administrative role claims that do not correspond to known service identities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T14:43:04Z","date_published":"2026-10-20T14:17:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-iofog-auth-bypass/","summary":"Eclipse ioFog Controller versions 3.8.0 through 3.9.1 contain an authentication bypass vulnerability in operator WebSocket endpoints, allowing attackers to access exec and log sessions using self-minted bearer tokens.","title":"Eclipse ioFog Controller: WebSocket Authentication Bypass (CVE-2026-113620)","url":"https://feed.craftedsignal.io/briefs/2026-10-iofog-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - IoFog Controller (3.8.0 Through 3.9.1)","version":"https://jsonfeed.org/version/1.1"}