CVE-2026-82955 Eclipse Foundation CVE debrief

Who should care

Organizations using the Eclipse aeriOS development version with KrakenD instance in the API Gateway component should prioritize patching and review their configurations to prevent potential exploitation of the CVE-2026-82955 vulnerability.

Technical summary

The CVE-2026-82955 vulnerability involves a hard-coded disable_jwk_security parameter in the KrakenD instance of the Eclipse aeriOS development version's API Gateway component. This setting disables TLS certificate verification when retrieving the JSON Web Key Set (JWKS) used to validate bearer tokens. An attacker with the ability to intercept this communication could provide a malicious JWKS and compromise token validation. The issue has been addressed by making the parameter configurable through the boolean Helm value krakend.config.disableJwkSecurity, with a default value of false, ensuring that TLS certificate verification is enabled by default.

Defensive priority

Organizations using the Eclipse aeriOS development version with KrakenD instance in the API Gateway component should prioritize patching, as the hard-coded disable_jwk_security parameter could allow malicious JWKS and compromise token validation.

Recommended defensive actions

• Review and apply the configurable krakend.config.disableJwkSecurity Helm value to ensure TLS certificate verification is enabled.
• Inventory and assess the use of Eclipse aeriOS development version with KrakenD instance in the API Gateway component.
• Implement compensating controls, such as monitoring and exception tracking, until patching can be applied.
• Verify vendor remediation and apply patches as they become available.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-82955 issue involves a hard-coded disable_jwk_security parameter in the KrakenD instance of the Eclipse aeriOS development version's API Gateway component. This parameter disables TLS certificate verification when retrieving the JSON Web Key Set (JWKS) used for bearer token validation. The issue allows a potential attacker to intercept communication and provide a malicious JWKS, compromising token validation. The problem has been addressed by making the parameter configurable through the Helm value krakend.config.disableJwkSecurity, with a default value of false, ensuring TLS certificate verification is enabled by default. Evidence is based on CVE Program and NVD records, as well as source references from [email protected].

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.