CVE-2026-115216

CriticalCVSS 9.1/10Last modified Nov 4, 2026

Description

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.

Metrics

CVSS 4.0 9.1/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Eclipse Foundation	Eclipse ioFog	>= 3.8.0, < 3.9.2

References

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-115228.8A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortM CVE-2026-1152215.4A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assign CVE-2026-1152234.9The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text bl CVE-2026-1152244.1The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and categor CVE-2026-1152255.8The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate th CVE-2026-115238.8A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the file /goform/PortalAuth of the componen CVE-2026-1152309.8The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce CVE-2026-1152318.5In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback CVE-2026-1152379.8The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing u CVE-2026-115248.8A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRules of the file /goform/modifyWifiFilterR CVE-2026-1152416.5The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snaps CVE-2026-1152425.5The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its s