Security readout for executives and security teams
Plain-English summary
A development build of Eclipse aeriOS configured its KrakenD API Gateway to skip TLS certificate verification when downloading token-validation keys. An attacker able to intercept that network connection could substitute malicious keys and undermine bearer-token validation. The issue concerns an unreleased development version, so exposure depends on whether organizations deployed that build.
Executive priority
Prioritize immediate inventory of development or pre-release aeriOS deployments. Remediate promptly wherever the affected revision is running, especially across untrusted networks. Organizations using only official releases may have limited exposure, but should verify rather than assume.
Technical view
At revision 371ea2101e42aa6503161ce08bbe986e319a9c2f, KrakenD hard-coded disable_jwk_security to true without a Helm override. This permits unverified TLS during JWKS retrieval, creating CWE-295 and CWE-347 risks. The correction adds the boolean Helm value krakend.config.disableJwkSecurity and defaults it to false.
Likely exposure
Likely exposure is limited to environments built from the identified Eclipse aeriOS development revision or configurations retaining disable_jwk_security=true. The source states that aeriOS had not received an official release. No evidence identifies affected released packages or broader products.
Exploitation context
Exploitation requires an attacker to intercept or manipulate communication between KrakenD and the JWKS endpoint. Successful substitution could compromise token validation and affect downstream confidentiality and integrity. The supplied sources provide no evidence of active exploitation, and the CVE is not listed as KEV in the bundle.
Researcher notes
CVSS 4.0 is 9.0 with network reachability, low complexity, no privileges, and no user interaction, but attack requirements are present. The security impact arises from trust failure during JWKS acquisition rather than direct disclosure from KrakenD. Evidence does not establish exploit availability, observed attacks, or affected versions beyond the named revision.
Mitigation direction
- Update to the corrected API Gateway code or later vendor-approved revision.
- Set krakend.config.disableJwkSecurity to false in applicable Helm configuration.
- Redeploy affected gateway instances so the corrected setting takes effect.
- Review Eclipse guidance before applying changes to development deployments.
Validation and detection
- Identify deployments built from the affected development revision.
- Inspect Helm values and rendered KrakenD configuration for disable_jwk_security.
- Confirm disable_jwk_security is false after deployment.
- Verify JWKS retrieval rejects certificates that fail trusted TLS validation.
- Review authentication logs for unexpected JWKS or token-validation behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-347: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-82955 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N——eclipseVulnerability scoring details
Base CVSS 4.0 score
9CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/818CVE reference, eclipse
- https://github.com/eclipse-aerios/api-gateway/commit/e680c69c34b82db4944517198330cc447a1e8f98CVE reference, eclipse
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Certificate Validation
Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.