CVE-2026-113644: iofogctl command injection via Controller provisioning response

Q: Who can exploit this issue in practice?

An attacker needs the ability to alter the provisioning key or CA certificate returned by the Controller API. Exploitation occurs when an operator uses iofogctl to deploy or attach an agent and the CLI processes that manipulated response.

Q: Where do injected commands run?

The additional commands run on the remote agent host through the SSH commands issued by iofogctl. The vulnerable values are also concatenated into commands executed through a local shell by the operator's CLI.

Q: Are all affected iofogctl releases exposed during normal use?

Affected releases are exposed when they deploy or attach an agent and consume a Controller provisioning response that an attacker can modify. The vulnerable command differs by release: supported releases use edgelet commands, while older releases use iofog-agent commands.

Q: What should teams do if they cannot immediately upgrade?

Restrict and protect access to the Controller API and its provisioning responses so untrusted parties cannot modify the provisioning key or CA certificate. Avoid deploying or attaching agents with affected iofogctl versions against Controller infrastructure whose responses cannot be trusted.

Q: Which version fixes the vulnerability?

The issue is fixed in iofogctl version 3.9.2. Affected versions include 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1.

Published Oct 27, 2026

Updated

In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (edgelet provision and edgelet config cert on supported releases; iofog-agent provision and iofog-agent cert on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2.

Affected Software

1 affected component

Eclipse ioFog iofogctl>=1.0.0<=3.7.0, >=3.8.0-rc.1<=3.9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Eclipse ioFog iofogctl to a version that resolves this vulnerability.
Fixed in 3.9.2

Event History

Oct 27, 2026

CVE Published

via MITRE·11:43 AM

Data Sourced

via MITRE·11:43 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue in practice?

An attacker needs the ability to alter the provisioning key or CA certificate returned by the Controller API. Exploitation occurs when an operator uses iofogctl to deploy or attach an agent and the CLI processes that manipulated response.

Where do injected commands run?

The additional commands run on the remote agent host through the SSH commands issued by iofogctl. The vulnerable values are also concatenated into commands executed through a local shell by the operator's CLI.

Are all affected iofogctl releases exposed during normal use?

Affected releases are exposed when they deploy or attach an agent and consume a Controller provisioning response that an attacker can modify. The vulnerable command differs by release: supported releases use edgelet commands, while older releases use iofog-agent commands.

What should teams do if they cannot immediately upgrade?

Restrict and protect access to the Controller API and its provisioning responses so untrusted parties cannot modify the provisioning key or CA certificate. Avoid deploying or attaching agents with affected iofogctl versions against Controller infrastructure whose responses cannot be trusted.

Which version fixes the vulnerability?

The issue is fixed in iofogctl version 3.9.2. Affected versions include 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1.

CVE-2026-113644: iofogctl command injection via Controller provisioning response

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue in practice?

Where do injected commands run?

Are all affected iofogctl releases exposed during normal use?

What should teams do if they cannot immediately upgrade?

Which version fixes the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue in practice?

Where do injected commands run?

Are all affected iofogctl releases exposed during normal use?

What should teams do if they cannot immediately upgrade?

Which version fixes the vulnerability?