Eclipse ioFog 3.8-3.9.1 Vulnerable to WebSocket JWT Bypass for Admin Access
A critical flaw in Eclipse ioFog Controller versions 3.8.0 through 3.9.1 lets attackers bypass JWT checks on WebSocket routes to gain admin rights.
Key points
- CVE-2026-113620 affects Eclipse ioFog Controller versions 3.8.0 through 3.9.1.
- The flaw allows privilege escalation to admin via self-minted tokens on WebSocket routes.
- No vendor patch has been confirmed for this critical vulnerability yet.
Eclipse ioFog Controller versions 3.8.0 through 3.9.1 contain a critical authentication bypass. Attackers can gain administrative privileges by exploiting a flaw in WebSocket route verification.
What happened
The National Vulnerability Database records CVE-2026-113620 with a CVSS score of 9.8. This rating classifies the issue as critical severity. The flaw exists in Eclipse ioFog Controller versions 3.8.0 through 3.9.1. Operator WebSocket upgrades on exec and log routes fail to verify bearer JWTs. The system decodes the payload and uses groups or roles as RBAC subjects. An attacker can create a token with admin groups.
This matches the built-in admin role without requiring an account. No RoleBinding is needed for this escalation. The attacker must know the UUID of a microservice or fog. They can then open an exec or log session. HTTP routes are not affected by this specific issue. They verify the token before applying RBAC checks. Agent WebSockets also remain secure. They verify the fog token correctly.
Why it matters
This vulnerability allows administrative access to specific sessions. The lack of JWT verification on specific routes is a significant security gap. Attackers do not need valid credentials to escalate privileges. They only need to know the target UUID. This lowers the barrier for exploitation significantly. The flaw is classified under CWE-347 for incorrect verification of cryptographic signature. Systems running versions 3.8.0 through 3.9.1 are at immediate risk. The Eclipse Foundation lists these versions as affected. No workaround is mentioned in the source material. Users must assume exposure until a fix is available.
What to watch
- Monitor for new Eclipse ioFog Controller releases.
- Check for vendor announcements regarding CVE-2026-113620.
- Review logs for unauthorized WebSocket connections.
- Verify that exec and log routes are secured.
Who needs to act first
Teams should prioritize systems exposed to untrusted networks. Check which instances run versions 3.8.0 through 3.9.1. Isolate these systems from general network access if possible. Reduce exposure by restricting WebSocket connections to known IPs. Test any mitigation steps in a non-production environment first. Back
Background: CVSS score
The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.
Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes
What to do and how to stay safe
- Virtual patching blocks traffic signatures, not the vulnerable code itself.
- Internal attackers bypass network-edge protections entirely.
- Logic flaws like broken access control often evade signature-based detection.
Virtual patching buys time, it does not fix code. Apply the real patch as soon as possible to remove the underlying risk.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
