CVE-2026-113620
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec…
- Risk score
- 68/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Eclipse ioFog Controller versions 3.8.0 through 3.9.1 have a vulnerability where WebSocket upgrades on the exec and log routes do not verify the bearer JWT, allowing an attacker to open an exec or log session for a microservice or fog.
- Affected
- {'products': ['Eclipse ioFog Controller'], 'packages': [], 'versions': ['3.8.0', '3.9.0', '3.9.1']}
- Fix
- Check the linked advisory for a fix, as none is provided in the record.
- Exploitation
- No known exploitation
Not confirmed. 3.9.0 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.
Last activity 20 Oct 2026. Patch Forecast updates every hour.