Vulnerability record/PUBLISHED/Published Oct 27, 2026 11:34:47 UTC
CVE-2026-115216
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
Base score9.1/ 10
SeverityCriticalCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsPresentAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityLowVI
Vulnerable system availabilityLowVA
Subsequent system confidentialityHighSC
Subsequent system integrityHighSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityeclipse
Last updatedOct 27, 2026 11:34:47 UTC
PublishedOct 27, 2026 11:34:47 UTC
ReservedOct 22, 2026 07:31:32 UTC