CVE-2026-113619— Eclipse ioFog renders request templates before authentication
Quick assessment
Affected
Eclipse Foundation Eclipse ioFog
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Eclipse ioFog Controller 3.8.0 至 3.9.1 版本中，对于启用模板替换的路由，其 POST、PUT 和 PATCH 请求体会在未经身份验证和基于角色的访问控制（RBAC）检查之前，由一个未设置上限的 Liquid 引擎进行渲染。Bearer 令牌检查不会拒绝缺失或无效的令牌，且身份验证速率限制仅适用于用户登录路由。一个微小的 JSON 请求体即可导致控制器进程停滞或终止。匿名调用者无法接收到渲染后的结果，但该漏洞的影响在于控制平面的可用性，包括该进程中的代理 API 以及进程内
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113619
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Eclipse ioFog renders request templates before authentication
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse ioFog | 3.8.0 ~ 3.9.1 | - |
|
II. Public POCs for CVE-2026-113619
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113619
请登录查看更多情报信息。
Other References for CVE-2026-113619 (2)
Same Patch Batch · Eclipse Foundation · 2026-10-20 · 29 CVEs total
| CVE-2026-113620 | 9.8 CRITICAL | Eclipse ioFog operator WebSocket accepts an unverified JWT |
| CVE-2026-93475 | 9.3 CRITICAL | Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 |
| CVE-2026-94018 | 8.8 HIGH | NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Lengt |
| CVE-2026-92853 | 8.7 HIGH | Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure |
| CVE-2026-92843 | 8.7 HIGH | Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure |
| CVE-2026-95109 | 8.5 HIGH | Cortex-A7 module data validation checks only the first address of a caller-supplied range |
| CVE-2026-94192 | 8.5 HIGH | Module object deallocation can free a live ThreadX kernel object |
| CVE-2026-91186 | 8.4 HIGH | PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing |
| CVE-2026-91041 | 7.8 HIGH | FileX fault-tolerant log replay writes past the destination sector when mounting a crafted |
| CVE-2026-91189 | 7.1 HIGH | GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a hea |
| CVE-2026-95107 | 7.0 HIGH | Module object allocation size overflow corrupts the manager object pool |
| CVE-2026-93003 | 6.9 MEDIUM | NetX Duo Web HTTP server interprets request body content as HTTP header fields |
| CVE-2026-108062 | 6.9 MEDIUM | Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event |
| CVE-2026-94023 | 6.9 MEDIUM | Module delete dispatchers do not enforce kernel-object ownership before irreversible delet |
| CVE-2026-94024 | 6.9 MEDIUM | Module Manager object lookup validates one byte of a module's search name |
| CVE-2026-91059 | 6.8 MEDIUM | JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allo |
| CVE-2026-92449 | 6.8 MEDIUM | Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds wri |
| CVE-2026-92446 | 6.8 MEDIUM | GUIX binary resource loader reads past the end of a resource, because no length for it eve |
| CVE-2026-95108 | 6.8 MEDIUM | Deleting a user-mode module thread leaks its privileged kernel stack |
| CVE-2026-97400 | 6.8 MEDIUM | jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when ope |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Eclipse Foundation
-
CVE-2026-93003
NetX Duo Web HTTP server interprets request body content as -
CVE-2026-95107
Module object allocation size overflow corrupts the manager -
CVE-2026-94202
Module block-pool create validates two of the four parameter -
CVE-2026-95108
Deleting a user-mode module thread leaks its privileged kern -
CVE-2026-94024
Module Manager object lookup validates one byte of a module'
Same weakness: CWE-400
-
CVE-2026-113658
ApostropheCMS: Unauthenticated CSV import requests leave rej -
CVE-2026-112955
ApostropheCMS: Import archives can exhaust server storage an -
CVE-2026-95108
Deleting a user-mode module thread leaks its privileged kern -
CVE-2026-112915
filelock ReadWriteLock: a crafted lock database makes every -
CVE-2026-108062
Pre-authentication OIDC discovery and JWKS fetches run synch
V. Comments for CVE-2026-113619
No comments yet