CVE-2026-80515: CWE-647 Use of Non-Canonical URL paths for authorization decisions in Eclipse Foundation Eclipse Arrowhead

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1, the management-authorization gate uses request.getRequestURL().toString().contains("/mgmt/") to decide whether to apply authorization checks. However, Tomcat returns the URL un-decoded, while Spring MVC routes on the decoded path. An attacker can use percent-encoded characters (e.g., %6D for 'm') to bypass the substring check, causing the filter to skip authorization. Since Spring Security's StrictHttpFirewall does not block percent-encoded ASCII letters, any authenticated system can reach management endpoints, including POST /authentication/mgmt/identities, which allows creation of new sysop accounts and full administrative takeover of the local cloud.

This vulnerability allows any authenticated user, regardless of their privilege level, to bypass authorization checks on management REST endpoints. This includes the ability to create new administrative accounts, effectively granting full administrative control over the local cloud environment. The impact is high due to the potential for complete system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to management endpoints to trusted users and networks only, and monitor for suspicious activity involving percent-encoded URLs targeting /mgmt/ paths.