Eclipse ioFog iofogctl Vulnerability Affecting Remote Command Execution

CVE-2026-113644

What is CVE-2026-113644?

Eclipse ioFog's iofogctl, specifically in versions 1.0.0 to 3.7.0 and 3.8.0-rc.1 to 3.9.1, is vulnerable due to concatenation of the provisioning key and CA certificate in shell commands executed over SSH. This vulnerability allows attackers to manipulate the API response to inject shell metacharacters, leading to potential execution of unwanted commands on the agent host when deploying or attaching an agent. The issue has been fixed in version 3.9.2, which mitigates the risk associated with this flaw.

References