CVE-2026-84736

The Federator component of Eclipse aeriOS, in its current development version (no official release has been published yet), disables TLS certificate validation for outbound HTTPS connections by default. The flaw is triggered when the TLS_CERTIFICATE_VALIDATION environment variable is unset or explicitly set to false, which causes the component's HTTP transport to skip certificate verification. An attacker positioned to intercept network traffic, such as an on-path man-in-the-middle, could impersonate the external services the Federator communicates with and capture sensitive HTTPS traffic, including OAuth client credentials and bearer tokens. Only deployments running the unreleased development builds — typically via the Helm chart or Docker Compose default configuration — are affected. No public proof of concept is known, the flaw is not listed in CISA KEV, and EPSS currently estimates a 0.2% probability of exploitation within 30 days.

What to do: If you run development builds of the aeriOS Federator, redeploy using the updated Helm chart or Docker Compose configuration in which TLS_CERTIFICATE_VALIDATION defaults to true, or explicitly set TLS_CERTIFICATE_VALIDATION=true in your environment. Check your current deployment for overrides that set the variable to false, and treat any OAuth client secrets or bearer tokens used by the Federator as potentially exposed if the deployment operated over untrusted networks. Monitor the Eclipse project for the first official release containing the default-on validation fix.