Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86464

Quick assessment

Affected
Eclipse Foundation Eclipse aeriOS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在当前 Eclipse aeriOS 的开发版本中（该版本尚未正式发布），身份管理器（IdM）的部署采用了不安全默认配置和安全敏感服务的默认凭证。 Helm Chart 默认通过 Kubernetes NodePort 服务暴露了 Keycloak 服务及其背后的 PostgreSQL 数据库；同样地，Docker Compose 部署方式也将 PostgreSQL 暴露在所有网络接口上。部署中包含了用于 Keycloak 管理员和 PostgreSQL 数据库用户的固定默认凭证，而之前的 Helm Chart 配

CVSS 9.9 · Critical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Eclipse Foundation Eclipse aeriOS 459fa98e95b1865d01b8d14d6cce5908ba2b18ba< c6efc450baf912385681198b2477c1ba4e93f91a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86464

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed the Keycloak service and its PostgreSQL backing database through Kubernetes NodePort services by default, while the Docker Compose deployment similarly exposed PostgreSQL on all network interfaces. The deployment included fixed default credentials for the Keycloak administrator and PostgreSQL database user, and the previous Helm chart configuration did not provide adequate secret management for these credentials. In addition, predefined application users with known credentials were provided for development and testing without sufficiently warning operators against their use in production environments. An attacker able to reach the exposed services could use the published default credentials to obtain administrative access to the Identity Manager or direct access to its database. This could allow unauthorized access to or modification of identity-management data, including users, roles, client credentials, sessions, and cryptographic material, and could enable the creation of privileged identities or tokens accepted by other aeriOS components. The issue has been addressed by generating a random Keycloak administrator password by default, managing Keycloak and PostgreSQL credentials through Kubernetes Secrets, and restricting PostgreSQL to an internal service in both the Helm chart and Docker Compose deployment. OpenLDAP is also restricted to an internal service. The predefined users intended for development and testing are retained, but the documentation now explicitly warns that their default credentials must not be used in production and that these users should be removed or their credentials changed after installation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse aeriOS 459fa98e95b1865d01b8d14d6cce5908ba2b18ba ~ c6efc450baf912385681198b2477c1ba4e93f91a -

II. Public POCs for CVE-2026-86464

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86464

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-86464 (1)

Vendor Advisories for CVE-2026-86464 (2)

Vendor Pages for CVE-2026-86464 (1)

Same Patch Batch · Eclipse Foundation · 2026-09-08 · 5 CVEs total

CVE-2026-84197 9.2 CRITICAL Ditto Node.js客户端 1.0.0-3.9.0 WebSocket TLS验证缺失
CVE-2026-12611 8.7 HIGH Jetty HTTP/2竞态条件导致服务器无响应
CVE-2026-19203 8.3 HIGH Jetty特制HTTP分块请求致请求走私漏洞
CVE-2026-86590 6.3 MEDIUM Eclipse Che 7.79.0-7.121.0 服务端请求伪造（SSRF）

IV. Related Vulnerabilities

Same product: Eclipse aeriOS
Same vendor: Eclipse Foundation
Same weakness: CWE-200

V. Comments for CVE-2026-86464

No comments yet

Leave a comment