Quick answers
- Is CVE-2026-15704 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15704 being exploited in the wild.
- How severe is CVE-2026-15704?
- Critical severity, with a CVSS score of 9.8, published 24 July 2026.
- Which products and versions are affected?
- Eclipse Foundation BaSyx Go Components <= 1.0.0.
- Is there a fix for CVE-2026-15704?
- A patch was published on 2026-07-03: Fix merged in pull request #442 and released in v1.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-15704 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-15704?
- Check whether you run Eclipse Foundation BaSyx Go Components at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authorization bypass exists in Eclipse BaSyx Go Components due to a discrepancy in how the ABAC middleware and the Chi HTTP router handle trailing slashes (CWE-180). The router was configured with 'middleware.StripSlashes', which normalized paths like '/shells/' to '/shells' before execution. However, the ABAC middleware evaluated the original path with the trailing slash; if it failed to find a matching policy for the slash-suffixed path, it permitted the request to proceed to the router. An unauthenticated remote attacker can exploit this by appending a '/' to API routes, bypassing ABAC policy enforcement and query filters. This affects multiple services including AAS and Submodel Repositories/Registries. The issue is resolved in version 1.0.1.
Affected products
- Eclipse Foundation BaSyx Go Components <= 1.0.0
Timeline
- 2026-07-03: patched: Fix merged in pull request #442 and released in v1.0.1
- 2026-07-24: disclosed: CVE-2026-15704 published