Live › vulnerability › CVE-2026-113644
Go to dashboardiofogctl builds shell commands by concatenating the provisioning key and CA certificate returned by the Controller API, then runs them over SSH on agent hosts and locally. A party who can alter that API response can inject shell metacharacters to run extra commands on the agent host when an operator deploys or attaches an agent.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 12:31 UTC. All times on this page are UTC.
Teams that use iofogctl to provision or attach ioFog edge agents, and whose Controller API traffic could be altered by someone other than the operator. Operators who only run iofogctl against a Controller they fully control, over a trusted path, are at much lower risk. Teams not using ioFog can skip it.
No product ranges from the sources yet.
iofogctl version and compare against the affected range: 1.0.0 through 3.7.0, and 3.8.0-rc.1 through 3.9.1.3.9.2.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (edgelet provision and edgelet config cert on supported releases; iofog-agent provision and iofog-agent cert on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-113644")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.