Authorization Bypass Vulnerability in Eclipse Arrowhead Management System

CVE-2026-80515

What is CVE-2026-80515?

In the Eclipse Arrowhead management system, versions 5.0.0 to 5.2.1 are susceptible to an authorization bypass vulnerability. The issue arises from the incorrect handling of URL encoding within the management-authorization gate that protects REST endpoints. When requests are made to specific endpoints using percent-encoded characters, the authorization check fails due to a mismatch in how Tomcat and Spring MVC process the request URL. As a result, authenticated users can bypass proper authorization controls, gaining access to sensitive management operations. This includes the ability to create new system operator accounts, potentially leading to a full administrative takeover of the local cloud environment.

References