# CVE-2026-15704: Eclipse BaSyx Go Components ABAC authorization bypass via trailing slash

Source: https://junglewise.ai/threats/cve-2026-15704-eclipse-basyx-go-components-abac-authorization-bypass-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-15704 · Severity: critical · CVSS 9.8 · Published 2026-07-24

Eclipse BaSyx Go Components, used for managing digital twins and industrial data, contains a security flaw in its access control system. An attacker can bypass security checks by simply adding a trailing slash to a web address (URL). This could allow unauthorized users to view, modify, or delete sensitive industrial data and configuration files.

Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation).

## Quick answers

**Is CVE-2026-15704 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15704 being exploited in the wild.

**How severe is CVE-2026-15704?** Critical severity, with a CVSS score of 9.8, published 24 July 2026.

**Which products and versions are affected?** Eclipse Foundation BaSyx Go Components <= 1.0.0.

**Is there a fix for CVE-2026-15704?** A patch was published on 2026-07-03: Fix merged in pull request #442 and released in v1.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15704 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15704?** Check whether you run Eclipse Foundation BaSyx Go Components at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in Eclipse BaSyx Go Components due to a discrepancy in how the ABAC middleware and the Chi HTTP router handle trailing slashes (CWE-180). The router was configured with 'middleware.StripSlashes', which normalized paths like '/shells/' to '/shells' before execution. However, the ABAC middleware evaluated the original path with the trailing slash; if it failed to find a matching policy for the slash-suffixed path, it permitted the request to proceed to the router. An unauthenticated remote attacker can exploit this by appending a '/' to API routes, bypassing ABAC policy enforcement and query filters. This affects multiple services including AAS and Submodel Repositories/Registries. The issue is resolved in version 1.0.1.

## Affected products

- Eclipse Foundation BaSyx Go Components <= 1.0.0

## Timeline

- 2026-07-03: patched: Fix merged in pull request #442 and released in v1.0.1
- 2026-07-24: disclosed: CVE-2026-15704 published

## References

- [https://github.com/eclipse-basyx/basyx-go-components/pull/442](https://github.com/eclipse-basyx/basyx-go-components/pull/442)
- [https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.0.1](https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.0.1)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/164](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/164)
- [https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/580](https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/580)