CVE-2026-84736

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification. As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens. The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.

• CWE-295

• https://github.com/eclipse-aerios/federator/commit/9c63b60becc9873b0195ff9cd6582b69cb12d4f2
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/755

Published

Sep 3, 2026

Last Modified

Sep 3, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84700PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replicat…8.6
• CVE-2026-84701NocoBase fails to sanitize rich text field values in the rea…5.4
• CVE-2026-84702facefusion through 3.6.1 fails to normalize job identifiers …7.5
• CVE-2026-84715FeatherPanel versions before 1.3.7.10 fail to validate permi…8.8
• CVE-2026-8472GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-84732Retransmissions of ACK packet ID in OpenVPN through 2.6.22 a…8.7
• CVE-2026-8474A vulnerability was discovered on Stormshield Network Securi…5.3
• CVE-2026-84745The Events Calendar WordPress plugin before 6.17.3.1 does no…2.7
• CVE-2026-84752Contributor PHP Object Injection in RTMKit <= 2.1.5 versions…8.8
• CVE-2026-84753Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 …9.8
• CVE-2026-84754Unauthenticated Broken Access Control in WPFunnels <= 3.12.1…6.5
• CVE-2026-84755Unauthenticated Broken Access Control in Mail Mint <= 1.31.0…6.5