CVE-2026-82955

In development builds of Eclipse aeriOS (which has not yet had an official release), the KrakenD instance embedded in the API Gateway component had the disable_jwk_security parameter hard-coded to true and could not be overridden via the Helm chart, turning off TLS certificate verification when KrakenD fetches the JSON Web Key Set (JWKS) used to validate bearer tokens. To exploit this, an attacker must be in a position to intercept that outbound HTTPS connection (for example, an on-path machine-in-the-middle on the network path between the gateway and the JWKS issuer) and substitute a malicious JWKS. By supplying attacker-controlled signing keys, the attacker can compromise token validation, gaining high integrity impact (CVSS 4.0 rates confidentiality impact as none). Affected parties are essentially early adopters running development builds of aeriOS deployed via the Helm chart; there is no fixed released version, and the fix lands in the development branch by making the setting configurable as krakend.config.disableJwkSecurity with a default of false. No public proof-of-concept or exploitation is known, and EPSS puts 30-day exploitation probability at 0.1%.

What to do: Since no fixed release exists, update to the latest development build of the aeriOS Helm chart that includes the krakend.config.disableJwkSecurity value, or explicitly set it to false in your values file. Also verify the network path from KrakenD to your JWKS issuer is over a trusted or restricted network, since exposure requires an on-path attacker.