Executive brief
Eclipse Ankaios is a container orchestration framework that uses Control Interface authorization rules to restrict which workloads can read or modify cluster state. A flaw in the authorization evaluator allows authenticated workloads to bypass access restrictions by submitting empty field masks to state requests, potentially exposing or modifying cluster configuration and other workloads outside their authorized scope. The vulnerability affects versions v0.5.1 through v1.0.1 and can be triggered only by authenticated users who already have some baseline access.
Technical details
The vulnerability is an authorization bypass in the agent-side Control Interface authorizer in Eclipse Ankaios. The flaw occurs when multi-segment allow rules have a wildcard as the first path segment (e.g., *.workloads.some_workload); the authorization logic incorrectly matches an empty field mask against these scoped wildcard rules, when only a rule consisting solely of "*" is intended to authorize unrestricted access. An authenticated workload can exploit this by submitting a CompleteStateRequest or UpdateStateRequest with an empty mask, bypassing the intended access scope and gaining the ability to read the complete cluster state or modify state outside its authorized subtree. The fix was merged in PR #790 and released in v1.0.2 (September 4, 2026). No evidence of active exploitation in the wild has been reported.
Affected products
- Eclipse Ankaios v0.5.1 through v1.0.1
Timeline
- 2026-09-07: disclosed
- 2026-09-04: patched: Fix released in v1.0.2