EUVD-2026-70056
GHSA-c22w-fx33-p435
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MITM prerequisite makes AC:H; no auth/interaction (PR:N/UI:N); forged tokens breach the protected backends beyond the gateway (S:C) with high confidentiality and integrity impact but no availability effect.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
4DescriptionCVE.org
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_security parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting disables TLS certificate verification when KrakenD retrieves the JSON Web Key Set (JWKS) used to validate bearer tokens, potentially allowing an attacker with the ability to intercept this communication to provide a malicious JWKS and compromise token validation.
The issue has been addressed by making the parameter configurable through the boolean Helm value krakend.config.disableJwkSecurity and setting its default value to false, ensuring that TLS certificate verification is enabled by default.
AnalysisAI
Improper certificate validation in the KrakenD-based API Gateway of Eclipse aeriOS allows a network man-in-the-middle to compromise bearer-token validation. The bundled KrakenD configuration hard-codes disable_jwk_security to true with no Helm override, so KrakenD skips TLS certificate verification (and in the shipped config fetched the JWKS over plaintext HTTP) when retrieving the JSON Web Key Set used to validate JWTs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a man-in-the-middle position on the communication path between the KrakenD API Gateway and the JWKS/Keycloak endpoint (CVSS AT:P) - for example, ARP/DNS spoofing, a rogue proxy, or compromise of a shared cluster network segment; the shipped configuration uses a plaintext http:// jwk_url with disable_jwk_security=true, which removes both transport encryption and certificate checks and makes interception straightforward. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 base score is 9.0 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N - note VC:N: this is an integrity/authentication-bypass issue, not confidentiality, which contradicts the 'Information Disclosure' tag applied in the input. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (commit e680c69c34b82db4944517198330cc447a1e8f98); no tagged/released patched version exists because aeriOS has not had an official release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all systems to confirm no pre-release aeriOS builds are deployed in production or internet-accessible environments, and isolate any development systems running aeriOS pre-release from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eclipse Aerios
View allPath traversal in Eclipse aeriOS Self-orchestrator prior to version 1.2.1 allows unauthenticated remote attackers to wri
TLS certificate validation is disabled by default in the Federator component of Eclipse aeriOS, enabling man-in-the-midd
Same weakness CWE-295 – Improper Certificate Validation
View allShare
External POC / Exploit Code
Leaving vuln.today