CVE-2026-113620

Summary

The Eclipse ioFog Controller has a critical authentication bypass vulnerability in its WebSocket upgrade endpoints for exec and log routes. Attackers can forge JWT tokens to gain admin-level access to microservices and fog nodes without proper authentication, allowing full control over the managed IoT infrastructure.

Exploitability

Exploitation is straightforward with minimal preconditions - attackers need only know a valid UUID of a target microservice or fog node, then can establish WebSocket sessions with forged admin tokens that bypass all RBAC checks.

Blast radius

The impact could be severe across an entire IoT deployment as attackers gain complete administrative access to all managed microservices and fog nodes, potentially leading to full system compromise and data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Eclipse ioFog Controller version 3.9.2 or later to address this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.