CVE-2026-86836: Eclipse Ankaios Privilege Escalation Flaw

CVE-2026-86836 Overview

CVE-2026-86836 affects Eclipse Ankaios versions 0.1.0 through 1.0.2. The Ankaios agent creates workload files and Control Interface named pipes (FIFOs) at a predictable path derived from the agent name and a hash of the workload runtime configuration. When restarting, the agent reuses existing paths based only on existence and file-type checks, without validating owner or permissions [CWE-276]. A local unprivileged user with write access to the base directory (by default $TMPDIR/ankaios, typically /tmp) can pre-create the path and FIFOs before the agent starts.

Critical Impact
A local attacker can impersonate a workload, complete the Control Interface handshake, and read or modify the cluster's desired state using the target workload's controlInterfaceAccess permissions.

Affected Products

Eclipse Ankaios 0.1.0 through 1.0.2
Eclipse Ankaios agent component (ank-agent)
Deployments using default $TMPDIR/ankaios base directory

Discovery Timeline

2026-09-14 - CVE-2026-86836 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-86836

Vulnerability Analysis

Eclipse Ankaios is an open-source orchestrator for containerized workloads in automotive and embedded environments. The agent provisions each workload with a Control Interface exposed through a pair of named pipes (FIFOs) inside a workload-specific directory. The directory path is deterministic, derived from the agent name and a hash of the workload's runtime configuration, so any local user can predict the location before the agent creates it.

On (re)start, the agent checks whether the target directory and FIFOs already exist. If they do, it reuses them without verifying ownership or permissions. An unprivileged local user with write access to the parent directory can pre-create the full path hierarchy and both Control Interface FIFOs. When the agent starts, it binds to the attacker-controlled FIFOs and treats them as the legitimate Control Interface for the targeted workload.

The attacker then completes the Control Interface handshake and submits requests using the workload's configured controlInterfaceAccess permissions. Depending on those permissions, the attacker can read or modify the cluster's desired state, effectively impersonating the workload within the orchestration control plane.

Root Cause

The root cause is Incorrect Default Permissions [CWE-276] combined with unsafe reuse of pre-existing filesystem objects in a world-writable directory. The agent trusts the existence and type of a path rather than validating its owner and permission bits, enabling a classic file-squatting condition against a predictable path.

Attack Vector

Exploitation requires local access with an unprivileged shell on the host and write access to the Ankaios base directory (by default under /tmp/ankaios). The attacker computes or observes the deterministic workload path, creates the directory and both FIFOs using mkfifo, and waits for the agent to start or restart. See the Eclipse Ankaios security advisory and pull request #799 for the technical fix details.

Detection Methods for CVE-2026-86836

Indicators of Compromise

Named pipes under $TMPDIR/ankaios/<agent>/<workload-hash>/ owned by a UID that does not match the Ankaios agent process owner.
Workload directories or FIFOs present before the Ankaios agent process starts or created by non-root, non-agent users.
Unexpected Control Interface requests modifying desired state, originating from workloads that should not hold write permissions.
Agent log entries indicating reuse of pre-existing Control Interface pipes at startup.

Detection Strategies

Audit filesystem creation events in $TMPDIR/ankaios using auditd or eBPF-based file monitoring for mkfifo and mkdir syscalls by non-privileged users.
Compare the ownership and mode of Control Interface FIFOs against the expected agent identity on each agent start.
Alert on Ankaios Control Interface requests whose behavior diverges from the workload's historical baseline.

Monitoring Recommendations

Continuously monitor /tmp/ankaios (or configured $TMPDIR/ankaios) for creation of files or directories by unexpected principals.
Log and review all changes to the cluster desired state issued through the Control Interface.
Track Ankaios agent restart events and correlate them with prior filesystem activity in the base directory.

How to Mitigate CVE-2026-86836

Immediate Actions Required

Upgrade Ankaios to version 1.0.3 or later, which enforces ownership and permission validation on Control Interface paths.
Restart the Ankaios agent only after removing any pre-existing content under the workload base directory.
Restrict write access to the Ankaios base directory so that only the agent's user account can create files there.

Patch Information

The fix is delivered in Eclipse Ankaios v1.0.3 via pull request #799. The patch validates ownership and permissions on Control Interface directories and FIFOs before reuse and refuses to bind to paths not owned by the agent.

Workarounds

Set $TMPDIR for the Ankaios agent to a directory that is not shared with unprivileged users, such as /var/lib/ankaios, with mode 0700 owned by the agent user.
Remove residual workload directories under the Ankaios base path during host boot before starting the agent.
Apply mandatory access controls (SELinux or AppArmor) restricting FIFO creation in the Ankaios base directory to the agent process.

bash

# Configuration example: relocate Ankaios base directory to a protected path
sudo install -d -o ankaios -g ankaios -m 0700 /var/lib/ankaios
sudo systemctl set-environment TMPDIR=/var/lib/ankaios
sudo find /tmp/ankaios -mindepth 1 -delete 2>/dev/null || true
sudo systemctl restart ank-agent