CVE-2026-82955

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82955

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82955.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82955

Published

2026-09-02T14:43:10.376Z

Modified

2026-09-04T03:47:27.480838691Z

Severity

9.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

[none]

Details

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting disables TLS certificate verification when KrakenD retrieves the JSON Web Key Set (JWKS) used to validate bearer tokens, potentially allowing an attacker with the ability to intercept this communication to provide a malicious JWKS and compromise token validation.

The issue has been addressed by making the parameter configurable through the boolean Helm value krakend.config.disableJwkSecurity and setting its default value to false, ensuring that TLS certificate verification is enabled by default.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82955.json",
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-295",
        "CWE-347"
    ]
}

References

Affected packages

Git / github.com/eclipse-aerios/api-gateway

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-aerios/api-gateway

Events

Introduced

Fixed

e680c69c34b82db4944517198330cc447a1e8f98

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82955.json"