TLS Verification Disabled in Eclipse ioFog Operator Affects Security Integrity

CVE-2026-115216

What is CVE-2026-115216?

The Eclipse ioFog Operator versions prior to 3.9.2 are susceptible to a security flaw due to disabled TLS certificate verification when contacting the Controller API and logging into external OIDC issuers. This flaw allows an on-path attacker to present any TLS certificate, potentially exposing OAuth client secrets or controller bootstrap admin passwords. Consequently, the attacker can access stored tokens for future Controller API interactions, thus compromising sensitive operations within the application, even though Keycloak has been removed in version 3.8. This vulnerability highlights the importance of enforcing robust certificate verification mechanisms.

References