CVE-2026-84173

Name of the Vulnerable Software and Affected Versions Eclipse Ankaios versions 0.5.1 through 1.0.1

Description The agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules when the first path segment is a wildcard. An authenticated workload restricted by such a rule can submit a CompleteStateRequest or UpdateStateRequest with an empty field mask. This can lead to the request being incorrectly authorized, enabling the workload to read the complete cluster state or replace state outside its authorized subtree, potentially resulting in unauthorized disclosure or modification of other workloads and cluster configuration.

Recommendations For versions 0.5.1 through 1.0.1, avoid using multi-segment Control Interface allow-rule filter masks that begin with a wildcard, such as *.workloads.some workload, and replace them with explicit paths such as desiredState.workloads.some workload where applicable.