WebSocket Vulnerability in Eclipse ioFog Controller Affects Authentication Mechanism

CVE-2026-113620

What is CVE-2026-113620?

In specific versions of the Eclipse ioFog Controller, a vulnerability exists in the WebSocket upgrade process for exec and log routes, whereby the validation of bearer JSON Web Tokens (JWTs) is insufficient. This flaw enables attackers with knowledge of a service's UUID to initiate unauthorized exec or log sessions by crafting self-minted tokens that meet role-based access control (RBAC) criteria. Unlike HTTP routes, which properly validate JWTs prior to granting access, the affected WebSocket routes fail to enforce robust security measures, resulting in potential exploitation. It is crucial for users running affected versions to apply available security updates and review their deployment configurations.

References