CVE-2026-84736
Deferred Deferred - Pending Action

TLS Certificate Validation Bypass in Eclipse aeriOS Federator

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Eclipse Foundation

Description
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification. As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens. The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-84736
EUVD
EUVD-2026-70599

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eclipse aerios *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Eclipse aeriOS involves the Federator component disabling TLS certificate validation by default for outbound HTTPS connections. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component skips TLS certificate verification, allowing attackers to intercept communications and impersonate external services.

Detection Guidance

Check if the TLS_CERTIFICATE_VALIDATION environment variable is set to false or unset in your Eclipse aeriOS Federator configuration. Inspect configuration files like docker-compose.yaml, helm-chart/values.yaml, or config.go for the variable. Monitor network traffic for HTTPS connections that bypass certificate validation, which may indicate exploitation attempts.

  • Verify environment variables: grep -r "TLS_CERTIFICATE_VALIDATION" /path/to/configs/
  • Check HTTP transport settings: Look for InsecureSkipVerify: true in Go code or HTTP client configurations.
Impact Analysis

An attacker could intercept sensitive data like OAuth client credentials and bearer tokens transmitted over HTTPS. This could lead to credential theft, authentication bypass, and unauthorized access to systems relying on these tokens for security.

Compliance Impact

This vulnerability could violate compliance requirements that mandate encryption and secure communication, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Failure to protect credentials and sensitive data in transit may result in non-compliance.

Mitigation Strategies

Immediately set TLS_CERTIFICATE_VALIDATION=true in all relevant configurations. Update Helm charts and Docker Compose files to enforce this setting. Restart the Federator component to apply changes. Ensure all outbound HTTPS connections enforce certificate validation to prevent MITM attacks.

  • Set environment variable: export TLS_CERTIFICATE_VALIDATION=true in deployment scripts or .env files.
  • Update configurations: Modify docker-compose.yaml, helm-chart/values.yaml, and config.go to enforce TLS validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart