CVE-2026-113620

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1 , a vulnerability exists where operator WebSocket upgrades on the exec and log routes fail to verify the bearer JWT . The system decodes the payload and uses the contained groups or roles as RBAC subjects . An attacker can provide a self-mi...

CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...