CVE-2026-84736: High severity Eclipse aeriOS vulnerability
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLSCERTIFICATEVALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification.
As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens.
The issue has been addressed by enabling TLS certificate validation by default. The TLSCERTIFICATEVALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the Helm chart and Docker Compose deployment, set the TLS_CERTIFICATE_VALIDATION environment variable to true so the Federator enables TLS certificate validation for outbound HTTPS connections.
Eclipse aeriOS Federator TLS_CERTIFICATE_VALIDATION = true - Configuration
Ensure TLS_CERTIFICATE_VALIDATION is not unset and not set to false; otherwise the Federator will configure its HTTP transport to skip TLS certificate verification.
Eclipse aeriOS Federator TLS_CERTIFICATE_VALIDATION = not unset/false
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of the Federator component are exposed when they make outbound HTTPS connections with TLS_CERTIFICATE_VALIDATION unset or set to false. Exploitation requires an attacker to be able to intercept communications between Federator and the external service.
Are default deployments affected?
The vulnerable behavior was the default when TLS_CERTIFICATE_VALIDATION was unset. The corrected Helm chart and Docker Compose default configuration set TLS_CERTIFICATE_VALIDATION to true.
What can be done if the updated deployment configuration cannot be applied immediately?
Set TLS_CERTIFICATE_VALIDATION to true explicitly for the Federator component. This causes its HTTP transport to verify TLS certificates for outbound HTTPS connections.
How can I determine whether my deployment is affected?
Check the Federator environment configuration for TLS_CERTIFICATE_VALIDATION. It is affected if the variable is absent or explicitly set to false.