CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113620?
CVE-2026-113620 is a critical vulnerability in Eclipse ioFog, published on 20 Oct 2026.
Official description
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.
Weakness: CWE-347
Which versions are affected by CVE-2026-113620?
How do I fix CVE-2026-113620?
No fix has been published for CVE-2026-113620 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113620 being exploited?
There is no known exploitation of CVE-2026-113620 in the wild and no public exploit code.
Sources
Also known as GHSA-26cx-x379-5j5c.