Eclipse Iofog (Eclipse Foundation) - vulnerabilities (CVEs)

4 CVEs, 4 in the last 30 days, 1 known versions, newest CVE from 2026-10-27. Vendor: Eclipse Foundation.

CVEs of Eclipse Iofog

• CVE-2026-113644 - CVSS 5.5 (medium), 2026-10-27: In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API…
• CVE-2026-115216 - CVSS 9.1 (critical), 2026-10-27: In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs…
• CVE-2026-113620 - CVSS 9.8 (critical), 2026-10-20: In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is…
• CVE-2026-113619 - CVSS 7.5 (high), 2026-10-20: In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped…