CVE-2026-80515

Name of the Vulnerable Software and Affected Versions Eclipse Arrowhead versions 5.0.0 through 5.2.1

Description An authorization bypass exists in the management-authorization gate protecting REST endpoints containing /mgmt/. The system determines whether to apply authorization checks by calling request.getRequestURL().toString().contains("/mgmt/"). Because Tomcat returns the request URL un-decoded while Spring MVC's DispatcherServlet routes based on the decoded path, an attacker can use percent-encoded characters to bypass the check. For example, requesting /serviceregistry/%6Dgmt/systems (where %6D is the letter m) bypasses the filter but is still dispatched to the management controller. Since Spring Security's StrictHttpFirewall allows percent-encoded ASCII letters, any authenticated system can access management operations, such as the POST /authentication/mgmt/identities endpoint, allowing the creation of new sysop accounts and full administrative takeover of the local cloud.

Recommendations Update Eclipse Arrowhead to a version later than 5.2.1.