# CVE-2026-115216: Eclipse ioFog Operator TLS certificate verification bypass

Source: https://junglewise.ai/threats/cve-2026-115216-in-eclipse-iofog-operator-versions-3-8-0-before-3-9-2-tls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-115216 · Severity: info · Published 2026-10-27

Eclipse ioFog Operator is a Kubernetes controller that manages ioFog edge computing deployments. Versions 3.8.0 through 3.9.1 disable TLS certificate verification when communicating with the Controller API and external identity providers, allowing an attacker on the network path to intercept credentials like OAuth secrets or bootstrap admin passwords. An attacker could then reuse these credentials to make unauthorized API calls and take control of the operator's configuration.

Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation).

## Quick answers

**Is CVE-2026-115216 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115216 being exploited in the wild.

**How severe is CVE-2026-115216?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Eclipse Foundation ioFog Operator 3.8.0 through 3.9.1.

**Is there a fix for CVE-2026-115216?** Yes: fixed in 3.9.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115216 attacked?** It is attacked over the network or from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-115216?** Check whether you run Eclipse Foundation ioFog Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.9.2

## Technical details

The vulnerability is a TLS certificate verification bypass in the ioFog Operator's connections to both the Controller API and external OIDC issuers. An on-path attacker can present any certificate to intercept sensitive credentials (OAuth client secret in external mode, or Controller bootstrap admin password in embedded mode), then reuse the stored access token for subsequent API calls. The fix in version 3.9.2 enforces TLS certificate verification and requires TLS 1.2 minimum for both Controller and issuer clients.

## Affected products

- Eclipse Foundation ioFog Operator 3.8.0 through 3.9.1

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/eclipse-iofog/iofog-operator/releases/tag/v3.9.2](https://github.com/eclipse-iofog/iofog-operator/releases/tag/v3.9.2)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/519](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/519)