CVE-2026-92611: Eclipse Ankaios Auth Bypass Vulnerability

CVE-2026-92611 Overview

CVE-2026-92611 is an authorization flaw in Eclipse Ankaios, a container workload orchestrator for automotive and embedded systems. The vulnerability affects the agent control-interface authorizer in versions 0.6.0 through 1.0.3. The LogRule::matches function halts evaluation at the first wildcard pattern within a rule instead of processing subsequent entries. This early termination causes deny LogRule entries to be skipped, letting a workload access another workload's logs without authorization. The issue is tracked under CWE-863: Incorrect Authorization and was fixed in version 1.0.4.

Critical Impact
A local authenticated workload can bypass deny rules in the control-interface authorizer to read logs belonging to co-located workloads, exposing sensitive runtime data.

Affected Products

Eclipse Ankaios 0.6.0 through 0.9.x
Eclipse Ankaios 1.0.0 through 1.0.3
Deployments using LogRule allow/deny rules in the agent control-interface authorizer

Discovery Timeline

2026-09-17 - CVE-2026-92611 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92611

Vulnerability Analysis

Eclipse Ankaios enforces per-workload access control through the agent control-interface authorizer. Operators define LogRule entries that allow or deny access to workload log streams. The authorizer is expected to evaluate every rule entry to reach a final allow/deny decision.

The LogRule::matches implementation exits the evaluation loop upon encountering the first wildcard pattern in a rule. Later entries in the same rule, including explicit deny entries, are never inspected. A caller can therefore construct or benefit from a rule ordering where a wildcard match short-circuits the check before a subsequent deny would fire.

The result is that a workload authenticated to the control interface can subscribe to log output belonging to other workloads on the same agent. Confidentiality of runtime logs is broken, while integrity and availability of the orchestrator itself remain intact.

Root Cause

The defect is a broken authorization primitive [CWE-863]. LogRule::matches uses short-circuit semantics that terminate rule evaluation at the first wildcard hit rather than continuing through the ruleset to honor later deny entries. The logic conflates "a pattern matched" with "the authorization decision is complete," ignoring the deny-overrides intent of the ruleset.

Attack Vector

Exploitation requires local access to an Ankaios agent's control interface with valid low-privilege credentials for at least one workload. The attacker uses the standard control-interface log subscription request against a target workload identifier. When authorizer rules for the caller include a wildcard entry followed by a deny for the target, the authorizer returns allow instead of deny, and the log stream is delivered. No user interaction is required. See the Eclipse Ankaios security advisory GHSA-qcqx-hx4v-25rg and the remediation pull request #805 for the corrected matching logic.

Detection Methods for CVE-2026-92611

Indicators of Compromise

Control-interface log subscription requests from a workload targeting workload names it does not own
Ankaios agent log entries showing successful log stream deliveries that cross workload boundaries
Presence of LogRule configurations that combine wildcard patterns with subsequent deny entries in the same rule

Detection Strategies

Inventory all deployed Ankaios agents and confirm the running version against the fixed release v1.0.4
Audit workload manifests for control-interface access grants and review LogRule ordering for wildcards followed by denies
Correlate control-interface request logs with expected workload-to-workload access patterns to surface anomalous cross-workload log reads

Monitoring Recommendations

Enable verbose authorizer decision logging on Ankaios agents to capture per-rule evaluation outcomes
Forward agent and control-interface telemetry to a centralized log platform for retention and correlation
Alert on any log subscription where the requesting workload identity does not match the target workload owner

How to Mitigate CVE-2026-92611

Immediate Actions Required

Upgrade all Ankaios installations to version 1.0.4 or later using the v1.0.4 release artifacts
Restrict which workloads are granted control-interface access to the minimum required set
Review and tighten LogRule definitions, replacing broad wildcards with explicit allow lists where feasible

Patch Information

The fix is delivered in Eclipse Ankaios v1.0.4. The corrected LogRule::matches implementation continues rule evaluation past wildcard matches so that subsequent deny entries are honored. Details are available in the GitHub pull request #805, the security advisory GHSA-qcqx-hx4v-25rg, and the Eclipse CVE assignment work item.

Workarounds

Remove LogRule entries that mix wildcard patterns with deny rules until the upgrade is applied
Revoke control-interface access for workloads that do not require log subscription capabilities
Isolate sensitive workloads onto dedicated agents so cross-workload log exposure is not possible

bash

# Verify the installed Ankaios version and upgrade if below 1.0.4
ank --version
# Expected output: ank 1.0.4 or later