CVE ID :CVE-2026-113620 Published : Oct. 20, 2026, 1:16 p.m. | 49 minutes ago Description :In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-113620 - Eclipse ioFog operator WebSocket accepts an unverified JWT

VERWANDTEARTIKEL

CVE-2026-113390 - DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection

CVE-2026-113391 - DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection

CVE-2026-105941 - Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

CVE-2026-105949 - Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

CVE-2026-105312 - Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

CVE-2026-9589 - Unblu Spark Authorization Bypass in Configuration Cascade Operations