{"id":"CVE-2026-113620","kind":"vulnerability","aliases":["CVE-2026-113620"],"related":[],"title":"Eclipse ioFog Controller: forged token grants admin exec and log access","description":"In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.","summary":"ioFog Controller 3.8.0 through 3.9.1 accepts unsigned JWTs on the operator WebSocket exec and log routes and uses the token's groups claim for RBAC. A forged token with groups:[admin] gives an interactive shell in any running microservice container, and live logs, for anyone who can reach the controller API port and knows a microservice or fog UUID. UUIDs can be listed with the same forged admin access. HTTP routes and agent sockets are not affected. Fixed in 3.9.2.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"eclipse-iofog-controller","fixed":["3.9.2"],"affected":">= 3.8.0, <= 3.9.1","ecosystem":"other"}],"ecosystems":[],"tags":["3.8.0-3.9.1","auth-bypass","eclipse-iofog-controller","edge-orchestration","infrastructure","other","self-hosted","websocket"],"not_affected_if":["agent-websockets-only","http-only-usage","version-outside-3.8.0-3.9.1"],"how_to_check":"Check the controller version (3.8.0 to 3.9.1 is affected), for example iofogctl version or the image tag of the controller deployment. Then check whether the controller API port (default 51121) is reachable from untrusted networks. Both ws:// and wss:// upgrades on /api/v3/microservices/exec/<uuid>, /api/v3/microservices/<uuid>/logs and /api/v3/iofog/<uuid>/logs are affected.","fix":"Upgrade the Controller to 3.9.2. Until then, do not expose the controller API port beyond trusted networks, and block WebSocket upgrades on the exec and logs routes at your proxy.","status":"open","published_at":"2026-10-20T13:16:41+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:33+00:00","updated_at":"2026-10-23T23:21:14+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown. Sources do not name a fixed version; upgrade past 3.9.1 once the vendor advisory confirms it.","reach":"internet","title":"Eclipse ioFog Controller: forged token grants admin exec and log access","impact":"high","summary":"In ioFog Controller 3.8.0 through 3.9.1, WebSocket exec and log routes skip JWT signature checks and trust the token's groups claim. An attacker can mint a token with an admin group and open exec or log sessions on any microservice or fog whose UUID they know.","category":"infrastructure","who_cares":["eclipse-iofog-controller","edge-orchestration","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker opens exec sessions on edge microservices and fogs as admin.","analyst_note":"Find the fixed release and vendor advisory for CVE-2026-113620 in the Eclipse ioFog project, and confirm whether the controller WebSocket endpoints are exposed beyond the internal network.","how_to_check":"Check the deployed controller version (3.8.0 to 3.9.1 is affected); unknown for a command-level check.","needs_analyst":true,"not_affected_if":["version-outside-3.8.0-3.9.1","http-only-usage","agent-websockets-only"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000551,"input_tokens":3051,"output_tokens":491,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed release and vendor advisory for CVE-2026-113620 in the Eclipse ioFog project, and confirm whether the controller WebSocket endpoints are exposed beyond the internal network.","search":"'-113620':14A,17A '-2026':13A,16A '3.8.0':22B,42B,125C '3.9.1':23B,44B,127C '3.9.2':119B 'accept':45B 'access':11A,108B 'account':175C 'admin':7A,70B,107B,165C,171C 'affect':116B,202C,218C 'agent':112B,209C 'alreadi':196C 'anyon':84B 'api':90B 'attack':180C 'auth':25B 'auth-bypass':24B 'bearer':141C 'built':169C 'built-in':168C 'bypass':26B 'claim':62B 'contain':79B,164C 'control':3A,30B,41B,89B,123C 'controller':21A 'cve':12A,15A 'decod':146C 'eclips':1A,28B,121C 'eclipse':19A 'eclipse-iofog-control':27B 'eclipse-iofog-controller':18A 'edg':32B 'edge-orchestr':31B 'exec':8A,52B,133C,184C 'fix':117B 'fog':97B,192C,213C 'forg':4A,66B,106B 'give':71B 'grant':6A 'group':61B,69B,149C,163C 'host':38B 'http':109B,198C 'infrastructur':34B 'interact':73B 'iofog':2A,20A,29B,40B,122C 'jwt':142C 'jwts':47B 'know':93B,197C 'list':102B 'live':81B 'log':10A,54B,82B,135C,186C 'match':166C 'microservic':78B,95B,190C 'mint':160C 'open':182C 'oper':50B,128C 'orchestr':33B 'payload':144C 'port':91B 'rbac':64B,155C,208C 'reach':87B 'role':151C,172C 'rolebind':178C 'rout':55B,110B,136C,199C 'run':77B 'self':37B,159C 'self-host':36B 'self-mint':158C 'session':187C 'shell':74B 'socket':113B 'subject':156C 'token':5A,59B,67B,161C,206C,214C 'unsign':46B 'upgrad':130C 'use':57B,153C 'uuid':98B,99B,194C 'verifi':139C,204C,211C 'version':124C 'websocket':39B,51B,129C,210C 'whose':162C,193C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T13:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113620","severity":null,"published_at":"2026-10-20T13:16:41+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113620:421","url":null,"severity":null,"published_at":"2026-10-23T23:21:14+00:00","modified_at":"2026-10-23T23:21:14+00:00","first_seen_at":"2026-10-23T23:21:14+00:00","fetched_at":"2026-10-23T23:21:14+00:00","note":"Fixed in Controller v3.9.2 (release notes, PR #870). Eclipse report #1270 describes the flaw and a pseudocode PoC, but the report is AI-generated and not human-confirmed. No exploitation reported. x-cli count for ioFog was 0 for the last 7 days. Whether the WebSocket port is exposed beyond the internal network depends on the deployment: the exec and log routes are served on the main API port, 51121 by default."}],"documents":[{"id":1904,"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1270","title":"Eclipse vulnerability report #1270: ioFog WebSocket RBAC trusts unverified JWT","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1906,"url":"https://github.com/eclipse-iofog/Controller/releases/tag/v3.9.2","title":"ioFog Controller v3.9.2 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}