CVE-2026-84173: CWE-863 Incorrect Authorization in Eclipse Foundation Eclipse Ankaios

CVE-2026-84173 is an incorrect authorization vulnerability in Eclipse Ankaios (versions 0.5.1 through 1.0.1). The agent-side Control Interface authorizer incorrectly processes multi-segment allow rules whose first path segment is a wildcard. Authenticated workloads restricted by such rules can submit CompleteStateRequest or UpdateStateRequest messages with empty field masks, which are then incorrectly authorized as matching the scoped rule. This allows unauthorized disclosure or modification of cluster state outside the intended subtree. Only a rule consisting solely of '*' is intended to authorize empty masks. The issue can lead to unauthorized access to or modification of other workloads and cluster configuration.

Exploitation of this vulnerability allows an authenticated workload to bypass intended access controls and read or modify the complete cluster state or state outside its authorized subtree. This can result in unauthorized disclosure of sensitive cluster information or unauthorized modification of workloads and cluster configuration, potentially impacting cluster integrity and confidentiality.

Until a fixed update is available, avoid using multi-segment Control Interface allow-rule filter masks that begin with a wildcard (e.g., '*.workloads.some_workload'). Instead, use explicit paths such as 'desiredState.workloads.some_workload' where applicable. A filter mask consisting solely of '*' should only be used when full-state access is intended. Monitor the vendor advisory for updates regarding an official fix.