{"id":"CVE-2026-115216","kind":"vulnerability","aliases":["CVE-2026-115216"],"related":[],"title":"Eclipse ioFog Operator: disabled TLS verification lets on-path attackers steal credentials","description":"In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.","summary":"The Eclipse ioFog Operator versions 3.8.0 before 3.9.2 does not verify TLS certificates when it contacts the Controller API or logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret or the Controller bootstrap admin password, and use the access token the operator stores.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eclipse-iofog","edge-computing","iofog-operator","kubernetes","oidc","package"],"not_affected_if":["pre-3.8.0","version-3.9.2-or-later"],"how_to_check":"- Check the installed ioFog Operator version; affected if it is `3.8.0` up to but not including `3.9.2`\n- Check whether the operator runs in external OIDC mode or embedded mode with Controller HTTPS enabled, since those expose the OAuth client secret or bootstrap admin password respectively","fix":"- Upgrade the Eclipse ioFog Operator to `3.9.2` or later\n- After upgrading, rotate the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode) and revoke any access tokens the operator stored","status":"open","published_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","triaged_at":"2026-10-27T12:31:58+00:00","updated_at":"2026-10-27T12:31:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T12:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Eclipse ioFog Operator to `3.9.2` or later\n- After upgrading, rotate the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode) and revoke any access tokens the operator stored","reach":"network","title":"Eclipse ioFog Operator: disabled TLS verification lets on-path attackers steal credentials","impact":"high","summary":"The Eclipse ioFog Operator versions 3.8.0 before 3.9.2 does not verify TLS certificates when it contacts the Controller API or logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret or the Controller bootstrap admin password, and use the access token the operator stores.","category":"package","nicknames":[],"who_cares":["eclipse-iofog","iofog-operator","kubernetes","edge-computing","oidc"],"confidence":0.7,"needs_auth":"unknown","worst_case":"On-path attacker steals OAuth client secret or admin password and tokens","analyst_note":"Check the NVD entry and the Eclipse ioFog advisory for exact affected config conditions and whether a fixed-version advisory exists beyond 3.9.2.","how_to_check":"- Check the installed ioFog Operator version; affected if it is `3.8.0` up to but not including `3.9.2`\n- Check whether the operator runs in external OIDC mode or embedded mode with Controller HTTPS enabled, since those expose the OAuth client secret or bootstrap admin password respectively","needs_analyst":true,"not_affected_if":["version-3.9.2-or-later","pre-3.8.0"],"who_is_affected":"Teams running the Eclipse ioFog Operator from 3.8.0 up to 3.9.2 that talk to the Controller API over a network an attacker could sit on, or that log in to an external OIDC issuer. Deployments on a trusted, isolated network still carry risk from anyone who can intercept traffic between the operator and the Controller. Teams on 3.9.2 or later, or running a version before 3.8.0, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000728,"input_tokens":3414,"output_tokens":773,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-115216':16A,19A '-2026':15A,18A '3.8.0':37B,92C '3.9.2':39B,94C 'access':82B,148C 'admin':77B,137C,170C 'api':50B,106C,156C 'attack':11A,63B,121C 'bootstrap':76B,136C 'call':157C 'captur':68B,126C 'certif':44B,67B,96C,125C 'client':71B,129C 'comput':25B 'contact':47B,103C 'control':49B,75B,105C,135C,142C,155C 'credenti':13A,163C 'cve':14A,17A 'disabl':4A,99C 'eclips':1A,21B,33B,88C 'eclipse-iofog':20B 'edg':24B 'edge-comput':23B 'embed':139C 'enabl':144C 'expos':162C 'extern':56B,114C,131C 'https':143C 'iofog':2A,22B,27B,34B,89C 'iofog-oper':26B 'issuer':58B,116C 'keycloak':160C,167C 'kubernet':29B 'later':154C 'let':7A 'log':52B,110C 'mode':132C,140C 'oauth':70B,128C 'oidc':30B,57B,115C 'on-path':8A,60B,118C 'oper':3A,28B,35B,85B,90C,102C,151C 'packag':31B 'password':78B,138C 'path':10A,62B,120C 'present':65B,123C 'realm':169C 'realm-admin':168C 'remov':159C 'secret':72B,130C,171C 'steal':12A 'store':86B,152C 'suppli':146C 'tls':5A,43B,95C 'token':83B,149C 'use':80B 'v3.8':158C 'verif':6A,97C 'verifi':42B 'version':36B,91C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Eclipse ioFog Operator from 3.8.0 up to 3.9.2 that talk to the Controller API over a network an attacker could sit on, or that log in to an external OIDC issuer. Deployments on a trusted, isolated network still carry risk from anyone who can intercept traffic between the operator and the Controller. Teams on 3.9.2 or later, or running a version before 3.8.0, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115216","severity":null,"published_at":"2026-10-27T12:17:07+00:00","modified_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","fetched_at":"2026-10-27T12:31:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}