External risk intelligence

Eclipse aeriOS API Gateway KrakenD JWKS Security Bypass.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-82955

The vulnerability exists within an API Gateway component, which is a network service typically deployed at the edge of a network to manage, route, and secure incoming traffic. Because API Gateways are designed to interface directly with external clients or services, this component is commonly exposed to the internet in real-world deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A development version of Eclipse aeriOS included an API Gateway component that improperly handled security settings for token validation. This could allow an attacker to compromise how security tokens are verified if they can intercept specific network communications. The issue has been addressed in subsequent development by enabling security checks by default.

API Gateway token validation security flaw.
Impacts external communication security.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could compromise token validation by intercepting communication between the API Gateway and the KrakenD instance. By manipulating the JSON Web Key Set (JWKS) provided to KrakenD, an attacker could bypass security checks and gain unauthorized access. This scenario requires the attacker to be in a position to intercept network traffic destined for the API Gateway.

Network traffic interception required.
Malicious JWKS provided to KrakenD.
Compromised token validation, leading to potential unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

The KrakenD instance within the API Gateway component could be tricked into accepting invalid JSON Web Key Set (JWKS) information if an attacker can intercept communication. This could occur when the API Gateway retrieves the JWKS to validate bearer tokens, potentially allowing for compromised token validation.

Token validation process
Intercepting network communication
Compromised token validation

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for API gateway infrastructure and the Eclipse aeriOS development lifecycle should address this vulnerability. The initial step involves identifying all KrakenD instances within the API Gateway component, confirming their exposure, and assessing their criticality to business operations. Subsequently, a remediation plan should be developed based on the identified risk, which may involve coordinating with the Eclipse development team or implementing temporary mitigating controls if direct patching is not immediately feasible.

API Gateway and Platform teams own resolution.
Verify KrakenD JWKS TLS verification is enabled.
Plan remediation based on verified exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Eclipse aeriOS API Gateway?

Eclipse aeriOS is an open-source project, and its API Gateway is a software component that sits between incoming web traffic and backend services. It manages and routes requests, acting as a central gatekeeper. A key part of its job is validating 'bearer tokens'—digital credentials that prove a user is allowed to access specific resources—to ensure only authorized traffic reaches your internal systems.

What is the weakness in CVE-2026-82955?

This vulnerability involves Improper Certificate Validation (CWE-295) and Improper Verification of Cryptographic Signature (CWE-347). The system failed to verify the identity of the server providing security keys used to check user tokens. Because it skipped this check, the gateway might blindly trust a malicious server, allowing an attacker to feed it fake security keys and bypass critical authentication protections.

How does an attacker trigger this vulnerability?

An attacker must be positioned to intercept network traffic flowing between the API Gateway and the service providing the security keys. If they can sit in the middle of this specific communication path, they can present a malicious, forged key set. Notably, simply sending standard traffic to the gateway does not trigger the bug; the attacker must actively manipulate the background exchange where the gateway fetches its validation keys.

Is my system at risk according to Halo Surface Signal?

Because the affected KrakenD instance resides within an API Gateway, it is designed to manage traffic from external sources. Halo Surface Signal identifies this as 'Likely' to be internet-facing in many deployments. If your specific instance of the development-stage Eclipse aeriOS API Gateway is positioned at the network edge to handle incoming traffic, it faces a higher probability of being reachable by external actors capable of interception.

How do I secure my API Gateway installation?

First, confirm if you are running the affected development version of Eclipse aeriOS. If so, your primary step is to ensure that TLS certificate verification is active for JWKS retrieval. You should update your configuration to set the 'krakend.config.disableJwkSecurity' parameter to false. This forces the gateway to verify the authenticity of the security keys it receives, closing the loophole that allows attackers to provide fraudulent keys.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.