Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.6
CVE-2026-84173: Eclipse Ankaios lets unauthorized workloads view or change cluster state
CVE-2026-84173 · published 1 month ago
Summary
Versions 0.5.1 through 1.0.1 of Eclipse Ankaios can mistakenly grant a workload permission to see or alter the whole system when a rule that starts with a “*” is used. This could expose other workloads’ data or let a component change settings it shouldn’t. Until a patch is applied, use only explicit paths in allow‑rules (for example desiredState.workloads.myApp) and avoid rules that begin with a “*”.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eclipse foundation | eclipse ankaios | <= 1.0.1 |
Original advisory text
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticat...
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or UpdateStateRequest with an empty field mask. The request may then be incorrectly authorized as matching the scoped rule, allowing the workload to read the complete cluster state or replace state outside its authorized subtree. This may result in unauthorized disclosure or modification of other workloads and cluster configuration. Only a rule consisting solely of * is intended to authorize an empty mask.
Mitigation: Until an update containing the fix is installed, avoid multi-segment Control Interface allow-rule filter masks that begin with a wildcard, such as *.workloads.some_workload. Replace them with explicit paths such as desiredState.workloads.some_workload, where applicable. A filter mask consisting solely of * has different, intentionally unrestricted semantics and should only be used when full-state access is intended.
Mitigation: Until an update containing the fix is installed, avoid multi-segment Control Interface allow-rule filter masks that begin with a wildcard, such as *.workloads.some_workload. Replace them with explicit paths such as desiredState.workloads.some_workload, where applicable. A filter mask consisting solely of * has different, intentionally unrestricted semantics and should only be used when full-state access is intended.
References
- https://github.com/eclipse-ankaios/ankaios/pull/790 Patch
- https://github.com/eclipse-ankaios/ankaios/releases/tag/v1.0.2 URL
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/853 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84173... Vendor Advisory
- https://github.com/eclipse-ankaios/ankaios/security/advisories/GHSA-rp6v-x3q5-cp... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84173 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.6
High
Type
CWE-863Incorrect Authorization
Timeline
Published7 Sep 2026
Updated26 Oct 2026
First seen8 Sep 2026
Track software like this
Free during beta