# CVE-2026-113619: Eclipse ioFog Controller unauthenticated template rendering DoS

Source: https://junglewise.ai/threats/cve-2026-113619-in-eclipse-iofog-controller-versions-3-8-0-through-3-9-1-post  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113619 · Severity: high · CVSS 7.5 · Published 2026-10-20

Eclipse ioFog Controller is a management platform for edge computing agents and applications. An unauthenticated attacker can send a small JSON request to multiple API routes that triggers uncontrolled template rendering, consuming excessive CPU and memory to crash the Controller process and disable the entire fleet's control plane, agent API, and WebSocket relays.

Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation).

## Quick answers

**Is CVE-2026-113619 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113619 being exploited in the wild.

**How severe is CVE-2026-113619?** High severity, with a CVSS score of 7.5, published 20 October 2026.

**Which products and versions are affected?** Eclipse Foundation ioFog Controller 3.8.0 through 3.9.1.

**Is there a fix for CVE-2026-113619?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-113619 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-113619?** Check whether you run Eclipse Foundation ioFog Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a pre-authentication resource exhaustion flaw in Liquid template rendering. Request bodies on 29 routes with substitution enabled are passed to an uncapped Liquid template engine before authentication and RBAC checks. The bearer token middleware does not reject missing or invalid tokens, allowing unauthenticated access; nested loops and range materialisation in templates consume unbounded CPU and memory from minimal input payloads, causing denial of service.

## Affected products

- Eclipse Foundation ioFog Controller 3.8.0 through 3.9.1

## Timeline

- 2026-10-20: disclosed

## References

- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/469](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/469)
- [https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1268](https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1268)