In Eclipse ioFog Operator versions 3.8.0 through 3.9.1 the operator disables TLS certificate verification when contacting the Controller API and when authenticating against an external OIDC issuer. This flaw allows an on‑path attacker to present any certificate and intercept credential exchanges, capturing the OAuth client secret in external mode or the Controller bootstrap admin password in embedded mode when HTTPS is enabled. The attacker can then reuse the captured credentials to forge an access token that the operator stores for future Controller API calls, effectively granting persistent unauthorized access to the fog environment.

The affected product is the Eclipse ioFog Operator from the Eclipse Foundation. Any deployment running a version earlier than 3.9.2—including 3.8.0, 3.8.1, 3.9.0, and 3.9.1—is vulnerable. The issue was fixed in release 3.9.2.

The CVSS score of 9.1 indicates high severity, and the vulnerability is not currently listed in CISA's KEV catalog. EPSS data is unavailable, but the lack of TLS verification makes it straightforward for a man‑in‑the‑middle attacker to spoof certificates and capture credentials, leading to significant compromise of confidentiality, integrity, and availability. Attack requires network proximity to the operator’s communication with the Controller API or the external OIDC endpoint.