CVE-2026-115216

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...

CVE-2026-115216 Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...

CVE-2026-115216

Eclipse ioFog Operator versions 3.8.0 before 3.9.2 are vulnerable to a security flaw where TLS certificate verification is disabled during communication with the Controller API and external OIDC issuers. This allows an on-path attacker to present any certificate to intercept sensitive credentials...

EUVD-2026-110758

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...

PT-2026-126388

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...