Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Attackers can seize administrative control of Eclipse ioFog instances by sending custom tokens over WebSocket connections, bypassing authentication checks entirely.
Key points
- Eclipse ioFog versions 3.8.0 through 3.9.1 contain a critical authentication bypass flaw.
- The vulnerability affects WebSocket upgrades on exec and log routes, not standard HTTP endpoints.
- No patch or remediation has been confirmed by the Eclipse Foundation for this issue.
An attacker who knows a microservice or fog UUID can gain full administrative access to Eclipse ioFog Controller instances. This occurs because the software fails to verify JSON Web Tokens during WebSocket upgrades. By crafting a token with admin groups, the user assumes an admin role without needing a valid account or RoleBinding. The flaw allows the creation of exec or log sessions that operate with elevated privileges, effectively granting the attacker control over the targeted services.
How it unfolded
- The attacker identifies a target microservice or fog UUID within the Eclipse ioFog environment.
- A custom JWT is created containing group claims that match the built-in admin role.
- The attacker initiates a WebSocket upgrade on the exec or log route using this unverified token.
- The system accepts the token and assigns admin privileges, enabling session control without authentication.
Who is affected
Eclipse ioFog Controller versions 3.8.0 through 3.9.1 are vulnerable to this authentication bypass. The flaw is specific to WebSocket connections used for executing commands or viewing logs. Standard HTTP routes remain secure because they verify tokens before applying role-based access controls. Agent WebSockets are also unaffected, as they verify the fog token independently. Organizations running these specific versions face direct risk if their WebSocket endpoints are accessible.
The fix
No vendor update or patch has been confirmed yet for CVE-2026-113620. The Eclipse Foundation has not released a version that resolves this WebSocket verification failure. Users of affected versions should monitor official channels for security advisories. Until a fix is available, exposure remains high for any instance using the vulnerable versions.
What made it possible
This incident illustrates a failure in trust boundary enforcement at the transport layer. Teams usually rely on application-level logic to validate session tokens, but transport upgrades often bypass standard middleware checks. When WebSocket handshakes do not re-verify authentication credentials, attackers can inject arbitrary claims. Check whether your infrastructure validates tokens at every connection stage, not just initial HTTP requests. Ensure that role assignments are strictly tied to verified user identities rather than raw token payloads.
What to do and how to stay safe: Eclipse ioFog
- Audit network access controls to restrict WebSocket endpoints to trusted internal networks only.
- Monitor logs for unusual exec or log session initiations that lack corresponding HTTP authentication events.
- Review configurations to ensure no public-facing routes expose WebSocket upgrade mechanisms without additional validation.
- Prepare an incident response plan assuming potential admin compromise of exposed ioFog instances.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Eclipse ioFog versions are vulnerable to this flaw?
Versions 3.8.0 through 3.9.1 are affected by CVE-2026-113620.
Does this vulnerability affect HTTP routes?
No, HTTP routes verify tokens before applying role-based access controls and are not affected.
Is there a patch available for this vulnerability?
No, no fix has been confirmed yet by the Eclipse Foundation.
