In Eclipse ioFog Controller versions 3.8.0 through 3.9.1 the operator WebSocket upgrade paths for exec and log do not verify the bearer JWT before applying role‑based access control. The unvalidated token is decoded and its group or role claims are used as RBAC subjects. An attacker can forge a token that includes the admin group, which maps to the built‑in admin role even without an account or RoleBinding. This allows the attacker to initiate an exec or log session on any microservice or fog node whose UUID is known, effectively executing arbitrary commands inside that container or process space.

The affected product is the Eclipse ioFog Controller by the Eclipse Foundation. Vulnerable releases are 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.9.0, and 3.9.1. No HTTP API routes or agent WebSocket connections are impacted.

The CVSS base score of 9.8 indicates critical severity. EPSS data is not available, so the likelihood of exploitation is uncertain, but the lack of JWT verification on a WebSocket endpoint used for command execution exposes a high‑risk attack surface. The attack vector is likely over the network by connecting to the exec or log WebSocket endpoints if the attacker knows the target UUID, leading to remote code execution. The vulnerability is not yet listed in the CISA KEV catalog, emphasizing the need for prompt remediation.