eclipse_iofog vulnerabilities
CVEs whose affected-version data names the eclipse_iofog package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-113619High· 7.5Eclipse ioFog renders request templates before authentication
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject …
▾ TwilightEclipse Foundation · Eclipse ioFogvia CVEORG
CVE-2026-113620Critical· 9.8Eclipse ioFog operator WebSocket accepts an unverified JWT
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token …
▾ MidnightEclipse Foundation · Eclipse ioFogvia CVEORG