CVE-2026-128790: Infoleak
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's FILTERLIST fragment filters to single Submodel reads.
GET /submodels removes the fields that a rule's FILTERLIST hides, but GET /submodels/{submodelIdentifier} and GET /submodels/{submodelIdentifier}/$metadata return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example supplementalSemanticIds keys that name the other parties allowed to read the Submodel.
If versioning is enabled (history.mode set to api or audit), GET /submodels/{submodelIdentifier}/$history and GET /shells/{aasIdentifier}/$history in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.
The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse BaSyx Go Componentsto a version that resolves this vulnerability.Fixed in v1.1.3
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use Eclipse BaSyx Go Components 1.1.2 or earlier with ABAC enabled in the Submodel Repository or AAS Environment. The history-related exposure additionally requires versioning to be enabled with history.mode set to api or audit.
What access does an attacker need?
An attacker must be authenticated and have READ access under the applicable access rules. For the history endpoints, their rules must grant READ access to those routes.
Are list responses affected in the same way as direct reads?
No. GET /submodels applies FILTERLIST field hiding, while single-Submodel reads and metadata reads do not. History endpoints can also return complete stored versions without applying formula or fragment filters.
What can be exposed through the history endpoints?
When versioning is enabled, the affected history endpoints can expose fields hidden by access rules, as well as Submodels and Asset Administration Shells that direct reads would not return to the caller.
What is the available remediation?
Upgrade to Eclipse BaSyx Go Components v1.1.3, which fixes the issue.