CVE-2026-80515: Eclipse Arrowhead Eclipse Arrowhead vulnerability
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat returns getRequestURL() un-decoded, while Spring MVC's DispatcherServlet routes on the decoded path. Requesting /serviceregistry/%6Dgmt/systems (%6D == m) therefore fails the substring check — the filter falls through without authorising — yet is decoded to /serviceregistry/mgmt/systems and dispatched to the management controller. Spring Security's StrictHttpFirewall (active via spring-boot-starter-security in arrowhead-common) only rejects encoded / \ . % ; and null bytes, so percent-encoded ASCII letters pass through. Any authenticated system — regardless of privilege — can reach every management operation, including POST /authentication/mgmt/identities which creates new sysop accounts, yielding full administrative takeover of the local cloud.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated system can exploit it, regardless of its assigned privilege level. An unauthenticated attacker is not described as able to reach the affected management operations.
What request pattern bypasses the authorization gate?
The bypass uses a percent-encoded ASCII letter in the /mgmt/ path segment, such as /serviceregistry/%6Dgmt/systems, where %6D decodes to m. The authorization filter examines the undecoded URL and misses /mgmt/, while Spring MVC decodes the path before dispatching it to the management controller.
Are default security controls sufficient to block the bypass?
No. Spring Security's StrictHttpFirewall is active through spring-boot-starter-security, but it rejects encoded slash, backslash, period, percent, semicolon, and null bytes rather than percent-encoded ASCII letters such as %6D.
What is the likely impact after successful exploitation?
An authenticated low-privilege system can access every management operation. This includes POST /authentication/mgmt/identities to create sysop accounts, which can result in full administrative takeover of the local cloud.
Which versions are affected?
Eclipse Arrowhead versions from 5.0.0 through 5.2.1 are affected.