CVE-2026-86836: High severity Eclipse Ankaios vulnerability
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a directory or FIFO already exists at that path when the agent (re)starts, the agent reuses it based only on an existence and/or file-type check, without validating its owner or permissions. A local, unprivileged user with write access to the same base directory (by default under $TMPDIR/ankaios, e.g. shared /tmp) can pre-create this path hierarchy, including the two Control Interface FIFOs, before the agent starts. The agent then treats the attacker-owned FIFOs as the legitimate Control Interface for the targeted workload. The attacker can complete the Control Interface handshake and issue requests using that workload's configured controlInterfaceAccess permissions, allowing impersonation of the workload and, depending on its configured permissions, unauthorized reading and/or modification of the cluster's desired state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent unprivileged users from pre-creating the Ankaios base directory and FIFO path under $TMPDIR/ankaios (e.g., shared /tmp). Ensure $TMPDIR/ankaios (and the specific predictable subpath derived from the agent name/hash) has permissions/ownership such that only the Ankaios agent user can create or modify directories/FIFOs there before agent startup/restart.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Agents running versions 0.1.0 through 1.0.2 are exposed when a local unprivileged user can write to the agent's base directory. The default location is under $TMPDIR/ankaios, which can be a shared location such as /tmp.
What must an attacker do to exploit it?
Before the agent starts or restarts, the attacker must pre-create the predictable workload path hierarchy and the two Control Interface FIFOs. The attacker then completes the Control Interface handshake and sends requests as the targeted workload.
What access can an attacker gain through a compromised Control Interface?
The attacker receives the permissions configured in the targeted workload's controlInterfaceAccess setting. Depending on that configuration, this can allow unauthorized reading or modification of the cluster's desired state.
What can be done if patching is not immediately possible?
Prevent unprivileged local users from writing to the agent's base directory, particularly when it is located in a shared temporary directory such as /tmp. Restarting an agent without addressing attacker-created paths can allow those paths and FIFOs to be reused.