CVE-2026-15704 Overview
CVE-2026-15704 is an authorization bypass vulnerability in Eclipse BaSyx Go Components versions up to and including 1.0.0. The flaw affects Attribute-Based Access Control (ABAC) enabled deployments and stems from inconsistent trailing-slash handling between the ABAC middleware and the Chi HTTP router. An unauthenticated network attacker can append a trailing slash to a protected API route to reach handlers that ABAC policy should deny. Depending on the exposed component and HTTP method, this permits unauthorized read, create, update, delete, or upload operations against Asset Administration Shell (AAS) services. The issue is fixed in Eclipse BaSyx Go Components v1.0.1.
Critical Impact
Unauthenticated attackers can bypass ABAC policy on AAS Repository, Submodel Repository, Registry, Discovery, and upload endpoints simply by appending / to the request path.
Affected Products
- Eclipse BaSyx Go Components versions up to and including 1.0.0
- ABAC-enabled deployments of AAS Repository, Submodel Repository, AAS Registry, Submodel Registry
- Concept Description Repository, Discovery, and AAS Environment upload services using the shared router
Discovery Timeline
- 2026-07-24 - CVE-2026-15704 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-15704
Vulnerability Analysis
The vulnerability is an authorization bypass classified under [CWE-180: Incorrect Behavior Order: Validate Before Canonicalize]. It results from a mismatch in how two request-processing layers interpret the URL path. The shared router configuration uses Chi's middleware.StripSlashes, so a request such as GET /shells/ is normalized and dispatched to the registered GET /shells handler. However, the ABAC middleware evaluates the original request path with the trailing slash intact. When the ABAC route lookup fails to match a slash-suffixed route, the middleware passes the request onward instead of denying it.
The router then strips the trailing slash and executes the protected handler without applying the intended ABAC authorization decision and without the expected ABAC query filters. This grants attackers direct access to protected API handlers.
Root Cause
The root cause is the ordering and inconsistent path canonicalization between the ABAC middleware and the Chi router. The ABAC middleware performs authorization decisions on the raw path, while middleware.StripSlashes normalizes the path only for routing. Non-canonical paths therefore evade the policy engine but still reach registered handlers.
Attack Vector
Exploitation requires only network access to the exposed BaSyx HTTP API. An attacker sends an HTTP request to a protected route and appends a trailing slash, for example GET /shells/, POST /submodels/, or PUT /concept-descriptions/. The ABAC middleware fails to match a policy rule for the slash-suffixed variant and forwards the request. The router then serves the request through the protected handler with no authorization applied and no ABAC query filters attached, exposing operations that policy would otherwise deny.
Refer to the Eclipse BaSyx GitHub Pull Request #442 and the GitLab Vulnerability Report #580 for the technical fix details.
Detection Methods for CVE-2026-15704
Indicators of Compromise
- HTTP access logs showing requests to BaSyx API routes with trailing slashes such as /shells/, /submodels/, /concept-descriptions/, or /registry/, especially from unauthenticated sources.
- Successful POST, PUT, DELETE, or upload responses on protected endpoints without a preceding successful authentication or authorization event in ABAC logs.
- Unexpected creation, modification, or deletion of AAS, Submodel, or Concept Description resources.
Detection Strategies
- Correlate router access logs against ABAC middleware decision logs to identify requests that were served without a corresponding ABAC evaluation entry.
- Alert on any HTTP request to BaSyx endpoints where the path ends in / and the response status indicates successful handler execution.
- Baseline API consumers and flag deviations, such as new source IP addresses invoking write or upload operations on repository services.
Monitoring Recommendations
- Enable verbose logging in the ABAC middleware to record both the evaluated path and the final decision for every request.
- Forward BaSyx service logs to a centralized SIEM and retain enough history to reconstruct pre-patch activity for compromise assessment.
- Monitor egress from AAS Environment upload endpoints for unexpected large file transfers that may indicate abuse of the bypass.
How to Mitigate CVE-2026-15704
Immediate Actions Required
- Upgrade all Eclipse BaSyx Go Components deployments to v1.0.1 or later, which corrects the trailing-slash handling in the ABAC middleware.
- Inventory every service that uses the shared router and ABAC middleware, including AAS Repository, Submodel Repository, Registries, Discovery, and upload services.
- Review recent access logs for requests containing trailing slashes on protected routes and investigate any resulting resource modifications.
Patch Information
The fix is available in Eclipse BaSyx Go Components v1.0.1. See the GitHub Release v1.0.1 and the corresponding Pull Request #442 for the code changes. Additional context is available in the Eclipse GitLab CVE Assignment #164.
Workarounds
- Place BaSyx services behind a reverse proxy or API gateway configured to normalize paths and strip trailing slashes before the request reaches the ABAC middleware.
- Restrict network exposure of BaSyx APIs to trusted management networks until the upgrade to v1.0.1 is complete.
- If patching is not immediately possible, disable public exposure of write-capable endpoints such as POST, PUT, DELETE, and upload routes on affected services.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
