Eclipse ioFog CVE-2026-113644

The attacker must be able to modify what the ioFog Controller API returns - a compromised or malicious Controller, or a machine-in-the-middle on the Controller API channel - so that the provisioning key or CA certificate contains shell metacharacters; these are then concatenated into the edgelet provision/edgelet config cert commands (or iofog-agent provision/iofog-agent cert on older releases) that iofogctl runs over SSH on the remote agent host and in the local shell. Exploitation only occurs when an operator actively deploys or attaches an agent (UI:A), and it does not work against a trusted/authentic Controller, which is the primary limiting factor alongside the high complexity of achieving control over the API response. Affected: iofogctl 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1; the only stated fix is upgrading to 3.9.2.

This is a moderate, conditional risk rather than a drop-everything emergency, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:A) encodes the real friction: although network-reachable and nominally unauthenticated against iofogctl itself, exploitation has high attack complexity because the attacker must be able to alter the Controller API response, and it requires operator interaction (UI:A) - the injection only fires when an operator runs iofogctl to deploy or attach an agent. The vulnerable system shows no direct impact (VC:N/VI:N/VA:N), but the subsequent system - the remote agent host and the operator's local shell - suffers full compromise (SC:H/SI:H/SA:H), which is why a 5.5 base score understates the consequence once the precondition is met. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation; the attack is best characterized as targeted, requiring a compromised/malicious Controller or a machine-in-the-middle position. The vuln.today 'this_month' priority aligns with that reading: patch within the normal cycle, not instantly. Key missing data: EPSS and SSVC automatable/exploitation values were not supplied, so probability of exploitation cannot be quantified beyond the qualitative signals.

An attacker who controls or can tamper with the ioFog Controller API response (a compromised Controller, a rogue/untrusted Controller, or a machine-in-the-middle on that channel) embeds shell metacharacters into the provisioning key or CA certificate field. When an operator later runs iofogctl to deploy or attach an agent, the CLI concatenates that attacker-influenced value into the edgelet/iofog-agent provision and cert commands, executing the attacker's injected commands over SSH on the remote agent host and in the operator's local shell. No public exploit identified at time of analysis; high attack complexity and the required operator action limit opportunistic use.