CVE-2026-113619: Eclipse ioFog renders request templates before authentication
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the availability impact?
An unauthenticated remote caller can trigger it. No valid bearer token, user interaction, or prior privileges are required.
What conditions must be present for exploitation?
The target must be an Eclipse ioFog Controller version 3.8.0 through 3.9.1 and expose a POST, PUT, or PATCH route that enables template substitution. A small JSON request body is sufficient to stall or abort the Controller process.
Does the existing authentication or rate limiting prevent this attack?
No. Template rendering occurs before authentication and RBAC, missing or invalid bearer tokens are not rejected at that stage, and the authentication rate limit covers only user login routes.
How can I determine whether an instance is affected?
Verify whether the Controller is running a version from 3.8.0 through 3.9.1. Then identify whether any reachable POST, PUT, or PATCH routes have template substitution enabled.
What services are disrupted if exploitation succeeds?
The Controller process can be stalled or aborted, affecting control-plane availability. This includes the agent API and in-process WebSocket relays running in that process.