CVE-2026-82955: Critical severity Eclipse aeriOS vulnerability
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting disables TLS certificate verification when KrakenD retrieves the JSON Web Key Set (JWKS) used to validate bearer tokens, potentially allowing an attacker with the ability to intercept this communication to provide a malicious JWKS and compromise token validation.
The issue has been addressed by making the parameter configurable through the boolean Helm value krakend.config.disableJwkSecurity and setting its default value to false, ensuring that TLS certificate verification is enabled by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the Helm value krakend.config.disableJwkSecurity to false so KrakenD performs TLS certificate verification when retrieving the JWKS used for bearer token validation.
API Gateway component (KrakenD instance) krakend.config.disableJwkSecurity = false
Event History
Frequently Asked Questions
Who is exposed to this issue?
Only deployments using the current development version of Eclipse aeriOS are affected; that version had not received an official release. The affected behavior is in the KrakenD instance included with the API Gateway component.
What must an attacker be able to do to exploit it?
An attacker must be able to intercept the KrakenD communication used to retrieve the JSON Web Key Set. They could then supply a malicious JWKS and compromise bearer-token validation.
Are default deployments affected?
Yes. The parameter was hard-coded to true and could not be overridden through the Helm chart, so TLS certificate verification for JWKS retrieval was disabled.
What configuration change addresses the issue?
Use the Helm value krakend.config.disableJwkSecurity and leave it set to its new default of false. This enables TLS certificate verification when KrakenD retrieves the JWKS.