Eclipse ioFog Controller CVE-2026-113619

Requires a Controller route that has template substitution enabled and accepts a POST, PUT, or PATCH body; such a body is rendered by an uncapped Liquid engine before the bearer-token and RBAC checks run, and the bearer check does not reject a missing or invalid token. No authentication is needed (PR:N) and the DoS rate limit does not apply because it is scoped only to user login routes. Limiting factors: only affected versions 3.8.0 through 3.9.1 are vulnerable, a template-substitution-enabled route must be reachable from the attacker, and impact is confined to availability of the control plane - no data is returned to the caller and there is no confidentiality or integrity impact.

Signals are largely consistent and point to a genuine, if impact-limited, availability threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a pre-authentication, network-reachable, low-complexity denial of service, and the description corroborates this: the bearer check fails open on missing/invalid tokens and the Liquid engine renders attacker-controlled POST/PUT/PATCH bodies before authentication and RBAC, with rate limiting scoped only to login routes. The real-world priority is tempered by scope: impact is strictly availability (C:N/I:N - the anonymous caller never receives rendered output, so this is not an SSRF/info-leak or RCE vector despite template injection being involved), and it is confined to the control plane of a niche edge/fog-computing product. EPSS is NOT provided in the input, so exploitation probability cannot be quantified. There is no KEV listing and no POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' One point to verify: exploitation is conditioned on routes that 'enable template substitution,' so the AC:L/PR:N default-exploitability rating assumes such a route is reachable in the deployment - confirm whether template substitution is enabled by default with the vendor. Net: a legitimate patch-worthy DoS for ioFog operators, but not a mass-exploitation emergency given the limited product footprint and availability-only impact.

An unauthenticated attacker with network access to the ioFog Controller sends a small crafted JSON body to a POST/PUT/PATCH route that has template substitution enabled. The uncapped Liquid engine evaluates the payload before any token or RBAC check, causing the Controller process to stall or abort and taking down the agent API and in-process WebSocket relays. No public exploit code is referenced, and the low-complexity/no-privilege vector makes a working request trivial to construct once the vulnerable route is identified.