CVE-2026-84736

    Dashboard / Vulnerabilities / CVE-2026-84736

    CVE-2026-84736

    Published: 3 Sept 2026Last Modified: 5 Sept 2026

    Summary:

    Details: In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification. As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens. The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.

    References: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/755, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84736.json, https://nvd.nist.gov/vuln/detail/CVE-2026-84736, https://github.com/eclipse-aerios/federator/commit/9c63b60becc9873b0195ff9cd6582b69cb12d4f2

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9c63b60becc9873b0195ff9cd6582b69cb12d4f2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-84736 | CVE-DB