Executive brief
Eclipse aeriOS's development version includes a KrakenD API Gateway instance that disables TLS certificate verification when fetching cryptographic keys (JWKS) used to validate user bearer tokens. An attacker intercepting network traffic could inject a malicious key set, causing the system to accept forged authentication tokens and granting unauthorized access to protected APIs and services.
Technical details
The vulnerability is a cryptographic configuration weakness in KrakenD's JWKS retrieval mechanism. The disable_jwk_security parameter was hard-coded to true in the development version with no override capability, disabling certificate verification for HTTPS connections to the JWKS endpoint. An attacker with network-level access (e.g., via ARP spoofing, DNS hijacking, or BGP interception) can perform a man-in-the-middle attack to intercept the JWKS request and supply a malicious key set. This allows forging valid bearer tokens that the gateway would accept, leading to complete authentication bypass. The fix makes the parameter configurable via Helm chart with a secure default (false), enabling TLS verification by default.
Affected products
- Eclipse aeriOS development version (pre-release)
Timeline
- 2026-09-02: disclosed
- 2026-08-27: patched: Fix committed to repository allowing configuration via Helm chart with secure default