CVE-2026-115216

The record

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.

Affected packages

Related vulnerabilities

• CVE-2026-118697 In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and… CWE-295
• CVE-2026-112816 Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10… CWE-295
• CVE-2026-119559 OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows… CWE-295
• CVE-2026-92744 Under certain conditions, privilege manager agent allows a remote unauthenticated… CWE-295
• CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-295
• CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-295
• CVE-2026-118780 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-295
• CVE-2026-119118 Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that… CWE-295