TLS Certificate Validation Vulnerability in Eclipse aeriOS Federator Component

CVE-2026-84736

What is CVE-2026-84736?

In the development version of Eclipse aeriOS, the Federator component disables TLS certificate validation by default for outbound HTTPS connections. This misconfiguration allows an attacker to intercept network communications, posing a risk of impersonation of external services and the potential exposure of sensitive information such as OAuth client credentials and bearer tokens. The issue has been mitigated in the newer configuration, where TLS certificate validation is enabled by default, ensuring secure communications.

References