---
id: "CVE-2026-115216"
kind: "vulnerability"
aliases: ["CVE-2026-115216"]
title: "Eclipse ioFog Operator: disabled TLS verification lets on-path attackers steal credentials"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["eclipse-iofog", "edge-computing", "iofog-operator", "kubernetes", "oidc", "package"]
not_affected_if: ["pre-3.8.0", "version-3.9.2-or-later"]
published_at: "2026-10-27T12:17:07+00:00"
first_seen_at: "2026-10-27T12:31:37+00:00"
updated_at: "2026-10-27T12:31:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115216", "first_seen_at": "2026-10-27T12:31:37+00:00"}]
---

# Eclipse ioFog Operator: disabled TLS verification lets on-path attackers steal credentials

The Eclipse ioFog Operator versions 3.8.0 before 3.9.2 does not verify TLS certificates when it contacts the Controller API or logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret or the Controller bootstrap admin password, and use the access token the operator stores.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ioFog Operator version; affected if it is `3.8.0` up to but not including `3.9.2`
- Check whether the operator runs in external OIDC mode or embedded mode with Controller HTTPS enabled, since those expose the OAuth client secret or bootstrap admin password respectively

## Fix

- Upgrade the Eclipse ioFog Operator to `3.9.2` or later
- After upgrading, rotate the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode) and revoke any access tokens the operator stored

## Timeline

- 2026-10-27T12:31:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115216

## From the sources

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_