Liquid Engine Vulnerability in Eclipse ioFog Controller Versions

CVE-2026-113619

What is CVE-2026-113619?

In the affected versions of Eclipse ioFog Controller, the POST, PUT, and PATCH methods on specific routes allowing template substitution are processed using an uncapped Liquid engine prior to executing authentication and role-based access control (RBAC) checks. This flaw results in a situation where missing or invalid tokens are not adequately rejected, and the authentication rate limiting mechanism is only applied to user login routes. A small JSON payload can disrupt or halt the Controller process, impacting the availability of the control plane, including key functionalities such as the agent API and in-process WebSocket relays. This exposes the system to potential misuse, particularly by anonymous callers unable to retrieve rendered results.

References