Is CVE-2026-84173 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84173 being exploited in the wild.

How severe is CVE-2026-84173?

Informational severity, published 7 September 2026.

Which products and versions are affected?

Eclipse Ankaios v0.5.1 through v1.0.1.

Is there a fix for CVE-2026-84173?

A patch was published on 2026-09-04: Fix released in v1.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84173 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-84173?

Check whether you run Eclipse Ankaios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84173: Eclipse Ankaios authorization bypass via multi-segment wildcard rules

CVE-2026-84173 · Severity: info · Published 2026-09-07

Eclipse Ankaios is a container orchestration framework that uses Control Interface authorization rules to restrict which workloads can read or modify cluster state. A flaw in the authorization evaluator allows authenticated workloads to bypass access restrictions by submitting empty field masks to state requests, potentially exposing or modifying cluster configuration and other workloads outside their authorized scope. The vulnerability affects versions v0.5.1 through v1.0.1 and can be triggered only by authenticated users who already have some baseline access.

Technologies: Eclipse Ankaios. Vendors: Eclipse.

Quick answers

Is CVE-2026-84173 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84173 being exploited in the wild.
How severe is CVE-2026-84173?: Informational severity, published 7 September 2026.
Which products and versions are affected?: Eclipse Ankaios v0.5.1 through v1.0.1.
Is there a fix for CVE-2026-84173?: A patch was published on 2026-09-04: Fix released in v1.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84173 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-84173?: Check whether you run Eclipse Ankaios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the agent-side Control Interface authorizer in Eclipse Ankaios. The flaw occurs when multi-segment allow rules have a wildcard as the first path segment (e.g., *.workloads.some_workload); the authorization logic incorrectly matches an empty field mask against these scoped wildcard rules, when only a rule consisting solely of "*" is intended to authorize unrestricted access. An authenticated workload can exploit this by submitting a CompleteStateRequest or UpdateStateRequest with an empty mask, bypassing the intended access scope and gaining the ability to read the complete cluster state or modify state outside its authorized subtree. The fix was merged in PR #790 and released in v1.0.2 (September 4, 2026). No evidence of active exploitation in the wild has been reported.

Affected products

Eclipse Ankaios v0.5.1 through v1.0.1

Timeline

2026-09-07: disclosed
2026-09-04: patched: Fix released in v1.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.