CVE-2026-84736

HighCVSS 8.3/10Last modified Sep 3, 2026

Description

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification.

As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens.

The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.

Metrics

CVSS 4.0 8.3/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-847379.8The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthent CVE-2026-847389.1The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing us CVE-2026-847398.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 t CVE-2026-84745.3A vulnerability was discovered on Stormshield Network Security * 4.3.0 to 4.3.41, * 4.8.0 to 4.8.15, * 5.0.0 to 5.0.5 CVE-2026-847406.5The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before m CVE-2026-847415.3The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details in CVE-2026-847422.7The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it CVE-2026-847433.8The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, al CVE-2026-847446.5The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them CVE-2026-847452.7The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public RES CVE-2026-84747Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to by CVE-2026-84748Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the pu