ioFog Operator CVE-2026-115216

Exploitation requires the attacker to hold an on-path (man-in-the-middle) position between the ioFog Operator and either the Controller API or the external OIDC issuer; this is the limiting factor that distinguishes it from a fully remote bug and corresponds to the AT:P metric. The underlying flaw is unconditional for affected versions: TLS certificate verification is disabled by default in Operator 3.8.0 through before 3.9.2 on these connections, so no non-default configuration is needed to make the operator accept a forged certificate. Which credential is exposed depends on deployment mode: external mode exposes the OAuth client secret; embedded mode exposes the Controller bootstrap admin password, and only when Controller HTTPS is enabled. No user interaction or prior authentication is required of the attacker beyond the network position.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 9.1 and the vuln.today decision label is act_now, with a vendor patch available (v3.9.2). The single most important nuance is the AT:P metric (Attack Requirements: Present): this is CWE-295 improper certificate validation, so exploitation requires the attacker to achieve an on-path/man-in-the-middle position between the ioFog Operator and either the Controller API or the external OIDC issuer - it is not a purely remote 'send a packet' bug. No EPSS score, no CISA KEV entry, and no POC reference are present in the supplied data; per the precision rules this means 'no public exploit identified at time of analysis.' Absence of EPSS/KEV/POC is not itself evidence of low risk, but it does mean active or widespread exploitation is not demonstrated here. The impact is serious once the on-path condition is met: the operator captures long-lived secrets (OAuth client secret in external mode, or the Controller bootstrap admin password in embedded mode with Controller HTTPS enabled) and accepts an attacker-supplied access token, which is why the 4.0 vector carries VC:H plus subsequent-system impact SC:H/SI:H. Net assessment: treat as act_now because of the credential-theft impact and available patch, while recognizing that the on-path prerequisite makes opportunistic internet-wide exploitation less likely than the raw 9.1 suggests.

An attacker who can intercept traffic on the network path between the ioFog Operator and the Controller/OIDC issuer (e.g. a compromised segment or rogue gateway in the edge/cluster network) presents any TLS certificate, which the operator accepts because certificate verification is disabled. In external mode the attacker harvests the OAuth client secret, or in embedded mode (Controller HTTPS enabled) the Controller bootstrap admin password, and feeds the operator an attacker-controlled access token used for subsequent Controller API calls. No public exploit code is identified at time of analysis, and the on-path requirement means this is not a one-shot remote exploit against an arbitrary internet host.