CVE-2026-113620: CWE-347 in Eclipse Foundation Eclipse ioFog

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, the operator WebSocket upgrade process on exec and log routes fails to verify bearer JWT tokens before using their decoded groups or roles for RBAC decisions. This allows an attacker to craft a self-minted JWT with admin groups, which matches the built-in admin role without requiring an account or RoleBinding. Consequently, the attacker can open exec or log WebSocket sessions for any microservice or fog instance whose UUID they know. HTTP routes and agent WebSocket connections are unaffected because they properly verify tokens before enforcing RBAC.

An attacker can bypass RBAC controls on operator WebSocket exec and log routes, gaining unauthorized access to exec or log sessions of microservices or fog instances. This leads to full confidentiality, integrity, and availability compromise (CVSS 9.8) of affected components. The vulnerability does not affect HTTP routes or agent WebSocket connections, which continue to enforce token verification.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to operator WebSocket exec and log routes and monitor for suspicious activity involving JWT tokens. Avoid exposing these routes to untrusted networks.