CVE-2026-86464
一分钟漏洞结论
影响对象
Eclipse Foundation Eclipse aeriOS
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在当前 Eclipse aeriOS 的开发版本中（该版本尚未正式发布），身份管理器（IdM）的部署采用了不安全默认配置和安全敏感服务的默认凭证。 Helm Chart 默认通过 Kubernetes NodePort 服务暴露了 Keycloak 服务及其背后的 PostgreSQL 数据库；同样地，Docker Compose 部署方式也将 PostgreSQL 暴露在所有网络接口上。部署中包含了用于 Keycloak 管理员和 PostgreSQL 数据库用户的固定默认凭证，而之前的 Helm Chart 配
可能的 ATT&CK 技术 1 AI
T1190 · Exploit Public-Facing Application影响版本矩阵 1
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Eclipse Foundation | Eclipse aeriOS | 459fa98e95b1865d01b8d14d6cce5908ba2b18ba< c6efc450baf912385681198b2477c1ba4e93f91a |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-86464 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
来源: CVE Program / CVE List V5
Vulnerability Description
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services.
The Helm chart exposed the Keycloak service and its PostgreSQL backing database through Kubernetes NodePort services by default, while the Docker Compose deployment similarly exposed PostgreSQL on all network interfaces. The deployment included fixed default credentials for the Keycloak administrator and PostgreSQL database user, and the previous Helm chart configuration did not provide adequate secret management for these credentials. In addition, predefined application users with known credentials were provided for development and testing without sufficiently warning operators against their use in production environments.
An attacker able to reach the exposed services could use the published default credentials to obtain administrative access to the Identity Manager or direct access to its database. This could allow unauthorized access to or modification of identity-management data, including users, roles, client credentials, sessions, and cryptographic material, and could enable the creation of privileged identities or tokens accepted by other aeriOS components.
The issue has been addressed by generating a random Keycloak administrator password by default, managing Keycloak and PostgreSQL credentials through Kubernetes Secrets, and restricting PostgreSQL to an internal service in both the Helm chart and Docker Compose deployment. OpenLDAP is also restricted to an internal service. The predefined users intended for development and testing are retained, but the documentation now explicitly warns that their default credentials must not be used in production and that these users should be removed or their credentials changed after installation.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
信息暴露
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse aeriOS | 459fa98e95b1865d01b8d14d6cce5908ba2b18ba ~ c6efc450baf912385681198b2477c1ba4e93f91a | - |
|
二、漏洞 CVE-2026-86464 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-86464 的情报信息
请登录查看更多情报信息。
CVE-2026-86464 补丁与修复 (1)
CVE-2026-86464 厂商安全公告 (2)
CVE-2026-86464 厂商页面 (1)
同批安全公告 · Eclipse Foundation · 2026-09-08 · 共 5 条
| CVE-2026-84197 | 9.2 CRITICAL | Ditto Node.js客户端 1.0.0-3.9.0 WebSocket TLS验证缺失 |
| CVE-2026-12611 | 8.7 HIGH | Jetty HTTP/2竞态条件导致服务器无响应 |
| CVE-2026-19203 | 8.3 HIGH | Jetty特制HTTP分块请求致请求走私漏洞 |
| CVE-2026-86590 | 6.3 MEDIUM | Eclipse Che 7.79.0-7.121.0 服务端请求伪造（SSRF） |
IV. Related Vulnerabilities
V. Comments for CVE-2026-86464
暂无评论