Read the docs
TI-2026-81134 Aliases CVE-2026-113644GHSA-w6f9-5453-8p69

Command injection in Eclipse ioFog iofogctl via provisioning response

Priority MEDIUM 58CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 before 3.9.2 are affected. The CLI concatenates the provisioning key and CA certificate from the Controller API response into shell commands without neutralizing special characters (CWE-78). A party who can alter that API response can inject shell metacharacters to run extra commands on the agent host when an operator deploys or attaches an agent.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00183 7th percentileScored 2026-11-08
Fix Fixed Eclipse ioFog (Eclipse Foundation): 3.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse ioFog1.0.0 – 3.7.0; 3.8.0-rc.1 to before 3.9.23.9.2Patch availableCNA
  • Eclipse ioFog VendorEclipse Foundation Affected 1.0.0 – 3.7.0; 3.8.0-rc.1 to before 3.9.2 Fixed in 3.9.2 Patch available CNA

Remediation

Eclipse ioFog iofogctl is fixed in version 3.9.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Eclipse ioFog (Eclipse Foundation) Fixed in 3.9.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Eclipse ioFog 3.9.2

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-81135 Certificate verification disabled in Eclipse ioFog OperatorPriority HIGH 72
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-113644
  2. 2026-10-27 Alias added: GHSA-w6f9-5453-8p69
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed
  5. 2026-11-04 Priority changed: LOW → MEDIUM
  6. 2026-11-06 Affected versions changed · Red Hat
  7. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
  • TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
  • TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
  • TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
  • TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences