CVE-2026-82955
Received Received - Intake

Hard-Coded JWK Security Bypass in Eclipse aeriOS

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Eclipse Foundation

Description
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_security parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting disables TLS certificate verification when KrakenD retrieves the JSON Web Key Set (JWKS) used to validate bearer tokens, potentially allowing an attacker with the ability to intercept this communication to provide a malicious JWKS and compromise token validation. The issue has been addressed by making the parameter configurable through the boolean Helm value krakend.config.disableJwkSecurity and setting its default value to false, ensuring that TLS certificate verification is enabled by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-82955
EUVD
EUVD-2026-70056

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
krakend krakend From false (inc)
eclipse aerios *
krakend krakend *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the development version of Eclipse aeriOS where the KrakenD API Gateway had the disable_jwk_security parameter hard-coded to true. This setting disables TLS certificate verification when KrakenD retrieves the JSON Web Key Set (JWKS) used for validating bearer tokens. An attacker could intercept this communication and provide a malicious JWKS to compromise token validation.

Detection Guidance

Check if the KrakenD instance in your Eclipse aeriOS deployment has the disable_jwk_security parameter set to true in its configuration. Inspect Helm chart values and template files for hardcoded true values. Verify if the krakend.config.disableJwkSecurity parameter is configurable and defaults to false.

Impact Analysis

An attacker could exploit this to bypass security controls and impersonate users by providing fake token validation keys. This could lead to unauthorized access to sensitive data or system functions if the API Gateway is used in authentication flows.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure authentication and data protection, such as GDPR's security principle or HIPAA's access controls. Unauthorized access risks could lead to data breaches, resulting in legal penalties and reputational damage.

Mitigation Strategies

Update the Helm chart to use the latest version where disableJwkSecurity defaults to false. Set krakend.config.disableJwkSecurity to false explicitly in your Helm values.yaml. Ensure TLS certificate verification is enabled for JWKS retrieval in KrakenD configuration files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82955. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart