CVE-2026-82955In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_security parameter hard…
Updated under an hour ago ()
Does this affect you?
It affects Eclipse Foundation Eclipse aeriOS. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_security parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting disables TLS certificate verification when KrakenD retrieves the JSON Web Key Set (JWKS) used to validate bearer tokens, potentially allowing an attacker with the ability to intercept this communication to provide a malicious JWKS and compromise token validation. The issue has been addressed by making the parameter configurable through the boolean Helm value krakend.config.disableJwkSecurity and setting its default value to false, ensuring that TLS certificate verification is enabled by default.
- CVSS
- 9.0 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
- Weakness (CWE)
- CWE-295, CWE-347
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- eclipse
- NVD analysis
- Deferred
- Record last updated
- Sep 2, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Eclipse Foundation Eclipse aeriOS eclipse_foundation:eclipse_aerios (from the name) | from 371ea2101e42aa6503161ce08bbe986e319a9c2f before e680c69c34b82db4944517198330cc447a1e8f98 | CNA record |
References
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/818
- https://github.com/eclipse-aerios/api-gateway/commit/e680c69c34b82db4944517198330cc447a1e8f98
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.