This article was published on October 28, 2026.
Preface: The primary design objective of the Eclipse ioFog Operator is to automate the lifecycle management and orchestration of an Edge Compute Network (ECN) control plane within a Kubernetes cluster. By acting as a Kubernetes-native extension, the Operator reconciles Custom Resources (specifically the ControlPlane CR) to automatically deploy, configure, and maintain core backend resources like the ioFog Controller, Routers, and NATS message fabrics.
Background: Referring to the accompanying infographic (highly heterogeneous edge environment), the Eclipse ioFog Operator does not directly touch or manage the underlying hardware chips (such as microcontrollers, GPUs, or FPGAs). Instead, it runs inside the cloud (or central data centre) Kubernetes cluster, where its sole job is to automatically deploy and maintain a central brain called the ioFog Controller. This Controller then communicates with the ioFog Agent (a lightweight edge daemon) installed on each piece of heterogeneous hardware, which abstract and handle the specific chip architectures.
CVE-2026-113620, which targets a major design flaw in the Eclipse ioFog Controller. This evasion design weakness is an Authentication Bypass, and its root cause stems from a classic cryptographic mistake: the ioFog Controller “only decodes, but does not verify” JWTs on specific WebSocket routes.
Because the Controller does not validate the signature, an attacker can easily execute a Self-Minted Token Attack:
1.Forge the Payload: The attacker crafts a malicious JSON payload manually, setting administrative roles (e.g., {“groups”: [“admin”]}).
2.Omit the Secret: The attacker packages this into a JWT format signed with a dummy key, a random password, or no signature at all.
3.Bypass Role-Based Access Control (RBAC): When this forged token is sent to the WebSocket endpoint, the Controller decodes it, reads the “admin” group, matches it against its internal RBAC rules, and grants full access.
While this exploit carries a prerequisite—the attacker must know or discover the specific UUID of the target microservice or Edge Node (Fog)—the consequences are severe once obtained:
•An attacker can open a WebSocket shell via /exec and execute arbitrary commands inside the remote edge containers.
•They can stream sensitive system logs through /log.
Note: Standard HTTP REST routes and the Agent-to-Controller WebSockets are safely designed and strictly verify tokens; this evasion vulnerability specifically isolated to the operator-facing maintenance WebSockets.
Immediate Patching: Upgrade the Eclipse ioFog Controller to the patched release version (3.9.2 or higher).
For a detailed analysis of CVE-2026-115216, please refer to the attached infographic.
Official announcement: Please refer below links for details –
https://www.tenable.com/cve/CVE-2026-113620
https://www.tenable.com/cve/CVE-2026-115216