Eclipse ioFog Controller: Authentication bypass in operator WebSocket exec and log routes
Summary
Eclipse ioFog Controller versions 3.8.0 through 3.9.1 do not verify the signature of the JWT on operator WebSocket upgrades for the exec and log routes. The token payload is only decoded and its groups are used for RBAC, so a self-minted token with the group admin gets full admin rights. An attacker who knows the UUID of a running microservice or fog can open an exec or log session, run commands inside the workload and read its logs. HTTP routes and agent WebSockets are not affected.
Affected
- Eclipse ioFog Controller 3.8.0 through 3.9.1
- Default configuration is affected
- Versions 3.7 and earlier were not part of the review
Fixed in
- Eclipse ioFog Controller 3.9.2 (verifies the access token before RBAC on user exec and log WebSockets)
Workaround
- Unknown. No vendor-documented interim workaround is available.
- As a general measure, restrict access to the Controller management interface to trusted networks.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- VulDB reports no known exploit. No public proof of concept found.
- Not marked as known exploited in current sources.
Our recommendation
- Upgrade Eclipse ioFog Controller to 3.9.2 if it runs version 3.8.0 to 3.9.1.
- Restrict network access to the Controller API port until the upgrade is done.
- Review the logs for unexpected exec or log WebSocket sessions.
- Review the other fixes in the same 3.9.2 release, especially the operator TLS certificate issue (CVE-2026-115216).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Eclipse GitLab CVE assignment #468 gitlab.eclipse.org
- Eclipse GitLab vulnerability report #1267 gitlab.eclipse.org
- Controller v3.9.2 release github.com
- OpenCVE CVE-2026-113620 app.opencve.io
- VulDB 422777 vuldb.com
- HOL CVE-2026-113620 hol.org
- Operator v3.9.2 release github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:23.
Original description (NVD)
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.