CVE-2026-84173: Eclipse Ankaios vulnerability
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or UpdateStateRequest with an empty field mask. The request may then be incorrectly authorized as matching the scoped rule, allowing the workload to read the complete cluster state or replace state outside its authorized subtree. This may result in unauthorized disclosure or modification of other workloads and cluster configuration. Only a rule consisting solely of is intended to authorize an empty mask.
Mitigation: Until an update containing the fix is installed, avoid multi-segment Control Interface allow-rule filter masks that begin with a wildcard, such as .workloads.someworkload. Replace them with explicit paths such as desiredState.workloads.someworkload, where applicable. A filter mask consisting solely of has different, intentionally unrestricted semantics and should only be used when full-state access is intended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In Eclipse Ankaios versions v0.5.1 through v1.0.1, avoid multi-segment allow-rule filter masks whose first path segment is a wildcard. Replace any such masks (e.g., `*.workloads.some_workload`) with explicit scoped paths (e.g., `desiredState.workloads.some_workload`) so empty filter masks cannot be incorrectly authorized as matching the scoped rule.
Eclipse Ankaios Control Interface authorizer (filter masks for allow rules) filter mask used in multi-segment Control Interface allow-rule filter masks = Avoid masks that begin with a wildcard like `*.workloads.some_workload`; replace with explicit paths such as `desiredState.workloads.some_workload` where applicable. Only use `*` (solely `*`) to authorize an empty mask intended to be unrestricted.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Eclipse Ankaios v0.5.1 through v1.0.1 are exposed when an authenticated workload is granted Control Interface access through a multi-segment allow-rule filter mask whose first segment is a wildcard.
What does an attacker need to do to exploit this issue?
The attacker must be an authenticated workload covered by an affected rule and submit a CompleteStateRequest or UpdateStateRequest with an empty field mask. The empty mask can then be incorrectly treated as matching the workload's scoped allow rule.
How should allow rules be changed if an update cannot be installed immediately?
Avoid multi-segment filter masks beginning with a wildcard, such as *.workloads.some_workload. Replace them with explicit paths, such as desiredState.workloads.some_workload, where applicable.
Does a rule containing only an asterisk have the same issue?
No. A filter mask consisting solely of * intentionally authorizes an empty mask and provides unrestricted full-state access; it should only be used when that level of access is intended.