Description
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or UpdateStateRequest with an empty field mask. The request may then be incorrectly authorized as matching the scoped rule, allowing the workload to read the complete cluster state or replace state outside its authorized subtree. This may result in unauthorized disclosure or modification of other workloads and cluster configuration. Only a rule consisting solely of * is intended to authorize an empty mask.




Mitigation: Until an update containing the fix is installed, avoid multi-segment Control Interface allow-rule filter masks that begin with a wildcard, such as *.workloads.some_workload. Replace them with explicit paths such as desiredState.workloads.some_workload, where applicable. A filter mask consisting solely of * has different, intentionally unrestricted semantics and should only be used when full-state access is intended.
Published: 2026-09-07
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized read or modification of cluster state via misrouted authorization rules
Action: Immediate Patch
AI Analysis

Impact

Eclipse Ankaios versions v0.5.1 through v1.0.1 contain an authorization flaw where the Control Interface authoriser incorrectly matches multi‑segment allow rules whose first segment is a wildcard. An authenticated workload restricted by such a rule can send a CompleteStateRequest or UpdateStateRequest with an empty field mask. The request may be incorrectly authorised, permitting the workload to read the entire cluster state or alter state outside its intended subtree, leading to disclosure or modification of other workloads and cluster configuration. This flaw is a classic example of a broken authorization logic (CWE‑863).

Affected Systems

The affected product is Eclipse Ankaios, part of the Eclipse Foundation. Vulnerable versions are v0.5.1 through v1.0.1. Versions released after v1.0.1, including the official v1.0.2 update, contain the fix.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an authenticated workload within the cluster that is permitted to submit state requests. If such a workload is compromised or misconfigured, the attacker can gain broader access to cluster state and configuration. Given the high impact of full‑state disclosure or modification, the risk is significant even though exploitation probability data is missing.

Generated by OpenCVE AI on September 7, 2026 at 14:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the v1.0.2 update or a newer release that includes the fix for the authorization logic
  • Review all Control Interface allow rules and replace any rule that begins with a wildcard (e.g., *.workloads.some_workload) with an explicit path such as desiredState.workloads.some_workload
  • Restrict the use of a filter mask consisting solely of * to only those situations where full‑state access is intentionally required; otherwise enforce more restrictive path specifications

Generated by OpenCVE AI on September 7, 2026 at 14:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse ankaios
Vendors & Products Eclipse
Eclipse ankaios

Tue, 08 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Title Authorization Flaw Enabling Unauthorized Cluster State Access in Eclipse Ankaios

Mon, 07 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Description In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or UpdateStateRequest with an empty field mask. The request may then be incorrectly authorized as matching the scoped rule, allowing the workload to read the complete cluster state or replace state outside its authorized subtree. This may result in unauthorized disclosure or modification of other workloads and cluster configuration. Only a rule consisting solely of * is intended to authorize an empty mask. Mitigation: Until an update containing the fix is installed, avoid multi-segment Control Interface allow-rule filter masks that begin with a wildcard, such as *.workloads.some_workload. Replace them with explicit paths such as desiredState.workloads.some_workload, where applicable. A filter mask consisting solely of * has different, intentionally unrestricted semantics and should only be used when full-state access is intended.
Weaknesses CWE-863
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Ankaios
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-09-08T15:03:21.136Z

Reserved: 2026-09-01T09:15:46.172Z

Link: CVE-2026-84173

cve-icon Vulnrichment

Updated: 2026-09-08T15:03:17.962Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T10:16:54.823

Modified: 2026-09-08T16:18:17.580

Link: CVE-2026-84173

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T20:38:05Z

Weaknesses