← Back to the live CVE advisory feed

CVE-2026-82955: Eclipse aeriOS

Severity

9 (CRITICAL)

Vendor

ECLIPSE

Affected versions

371ea2101e42aa6503161ce08bbe986e319a9c2f through before e680c69c34b82db4944517198330cc447a1e8f98

Patch status

Unknown

Published

2026-09-02T15:17:44.860

Modified

2026-09-02T15:17:44.860

Why it matters

This matters because the issue affects identity or token handling. Successful exploitation could allow unauthorized authentication, client manipulation, or access to protected services.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_security parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting disables TLS certificate verification when KrakenD retrieves the JSON Web Key Set (JWKS) used to validate bearer tokens, potentially allowing an attacker with the ability to intercept this communication to provide a malicious JWKS and compromise token validation. The issue has been addressed by making the parameter configurable through the boolean Helm value krakend.config.disableJwkSecurity and setting its default value to false, ensuring that TLS certificate verification is enabled by default.

View the official NVD record for CVE-2026-82955

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.