{"id":"CVE-2026-113620","published":"2026-10-20T13:16:41.610","lastModified":"2026-10-20T19:48:50.250","description":"In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/468","tags":[]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1267","tags":[]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1269","tags":[]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1270","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Eclipse ioFog Controller has a critical authentication bypass vulnerability in its WebSocket upgrade endpoints for exec and log routes. Attackers can forge JWT tokens to gain admin-level access to microservices and fog nodes without proper authentication, allowing full control over the managed IoT infrastructure.","exploitability":"Exploitation is straightforward with minimal preconditions - attackers need only know a valid UUID of a target microservice or fog node, then can establish WebSocket sessions with forged admin tokens that bypass all RBAC checks.","blast_radius":"The impact could be severe across an entire IoT deployment as attackers gain complete administrative access to all managed microservices and fog nodes, potentially leading to full system compromise and data exfiltration.","remediation":"Upgrade to Eclipse ioFog Controller version 3.9.2 or later to address this authentication bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","websocket","iot","rbac"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:23:34.530Z"}}