CVE-2026-113619
7.5HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Unauthenticated remote attackers can crash or hang the ioFog Controller process and disrupt the control plane, including agent APIs and WebSocket relays. All they need is network access to send a small, crafted JSON request to routes with template substitution.
Root cause
The Controller renders request bodies with an uncapped Liquid template engine prior to validating bearer tokens or checking RBAC.
Affected systems
Eclipse ioFog Controller versions 3.8.0 through 3.9.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to a version past 3.9.1 when available. If patching must wait, block or restrict unauthenticated network access to Controller HTTP routes (POST, PUT, PATCH) at your reverse proxy or firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.