CVE-2026-113620

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1 , a vulnerability exists where operator WebSocket upgrades on the exec and log routes fail to verify the bearer JWT . The system decodes the payload and uses the contained groups or roles as RBAC subjects . An attacker can provide a self-mi...