---
id: CVE-2026-115216
title: >-
  Eclipse ioFog Operator disables TLS certificate verification when sending
  Controller and OIDC credentials
summary: >-
  In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate
  verification is disabled when the operator contacts the Controller API and
  when it logs in to an external OIDC issuer. An on-path attacker can present
  any certificate…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:N'
cvssSource: cna
cwe:
  - CWE-295
vendor: Eclipse Foundation
product: Eclipse ioFog
affected:
  - eclipse_iofog >= 3.8.0 < 3.9.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T17:12:56.258582Z'
exploitAvailable: true
published: '2026-10-27'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T17:13:31.877Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115216'
references:
  - url: >-
      https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1064
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/519'
  - url: 'https://github.com/eclipse-iofog/iofog-operator/releases/tag/v3.9.2'
tags:
  - cve.org
  - exploit-available
epss: 0.00236
epssPercentile: 0.14651
ingestedAt: '2026-10-27T16:11:59.308Z'
---

## Overview

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.

## Affected

- `eclipse_iofog >= 3.8.0 < 3.9.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.