CVE-2026-128986: Medium severity Eclipse BaSyx Go Components vulnerability
In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match ROUTE access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (%2F) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow ROUTE rule while the handler returns a different, larger resource.
An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as /v1/dpps//elements/, meant to grant only passport elements, also grants the complete passport whose identifier contains /elements/. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as /submodels//submodel-elements//attachment, meant to grant only file attachments, also grants the complete element whose stored idShort contains %2F.
The issue is fixed in Eclipse BaSyx Go Components v1.1.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.1.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of Eclipse BaSyx Go Components up to and including 1.1.3 are affected when ABAC is enabled and ROUTE access rules are used. The described impact applies where rules restrict READ access to portions of a resource, such as DPP passport elements or repository attachments.
What does an attacker need to exploit this issue?
An attacker must be an authenticated caller with limited READ permissions granted by a narrow ROUTE rule. Exploitation relies on requesting a resource through a path containing an encoded slash (%2F) that causes the access check and router to interpret the path differently.
How can I determine whether my authorization rules are at risk?
Review ABAC ROUTE rules that grant access to nested resource paths while intending to exclude the parent resource. Examples include /v1/dpps/*/elements/* and /submodels/*/submodel-elements/*/attachment; affected stored identifiers can contain /elements/ or %2F in the relevant path value.
What is the remediation?
Upgrade Eclipse BaSyx Go Components to version 1.1.4, which fixes the issue. The provided data does not specify an alternative mitigation for deployments that cannot yet upgrade.