Eclipse ioFog Operator: Disabled TLS certificate verification
Summary
Eclipse ioFog Operator versions 3.8.0 before 3.9.2 do not verify TLS certificates when contacting the Controller API or an external OIDC issuer. An attacker on the network path between the operator and these services can present any certificate and capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled). The attacker can also obtain the access token that the operator stores for later Controller API calls. Exploitation requires a man-in-the-middle position; a remote attack on an internet-facing service is not described.
Affected
- Eclipse ioFog Operator 3.8.0 up to, but not including, 3.9.2
- The CVE record lists the default configuration as unaffected.
Fixed in
- Upgrade to Eclipse ioFog Operator 3.9.2 (released 26 Oct 2026)
- Do not use the release candidates 3.9.2-rc.1 and rc.2
Workaround
- No vendor-documented workaround. Upgrading to 3.9.2 is the remedy.
- Interim measure (our recommendation, not vendor guidance): keep traffic between the operator and the Controller or OIDC issuer off untrusted networks until the upgrade is done.
Exploitation
- No known exploitation.
- No public proof-of-concept found.
- Not listed in CISA KEV according to a third-party tracker (not checked directly).
Our recommendation
- Inventory ioFog operator, Helm chart and CLI deployments and their versions.
- Upgrade affected installations to 3.9.2. If used, also update related components such as the CLI and Go SDK.
- If the operator ran over an untrusted network path before the upgrade, rotate the OAuth client secret or the Controller bootstrap admin password and revoke tokens stored by the operator.
- Restrict network paths between the operator and the Controller or OIDC issuer.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub release v3.9.2 (eclipse-iofog/iofog-operator) github.com
- Pull request #79: TLS verification for Controller and OIDC github.com
- Eclipse CVE publication request #519 gitlab.eclipse.org
- Eclipse vulnerability report #1064 gitlab.eclipse.org
- VulDB entry 427172 vuldb.com
- Vulners OSV record CVE-2026-115216 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:23.
Original description (NVD)
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.