Executive brief
Eclipse Ankaios is a container orchestration and management platform used in automotive and embedded systems. A flaw in the log access authorization logic allows attackers to bypass deny rules and access logs from workloads they should not have permission to view, potentially exposing sensitive operational data.
Technical details
The vulnerability exists in the `LogRule::matches` function within the agent control-interface authorizer. The function prematurely stops evaluation at the first wildcard pattern in a rule, causing subsequent deny entries to be skipped. This allows an attacker to bypass authorization checks and gain unauthorized access to logs of other workloads. The issue affects versions 0.6.0 through 1.0.3, and no special preconditions (authentication or network access beyond normal Ankaios operation) are required beyond having some form of access to the log system. The vulnerability was patched in version 1.0.4 (released 17 Sep 2026).
Affected products
- Eclipse Ankaios 0.6.0 to before 1.0.4
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fixed in version 1.0.4