Eclipse Ankaios Vulnerability in Control Interface Authorization

CVE-2026-84173

What is CVE-2026-84173?

In multiple versions of Eclipse Ankaios, an authorization flaw exists within the Control Interface that mishandles multi-segment allow rules beginning with a wildcard. An authenticated workload may exploit this misconfiguration to submit requests that could be improperly authorized, thereby enabling unauthorized access to sensitive cluster states or the ability to modify configurations beyond intended access limits. To safeguard against this, administrators are advised to replace problematic wildcard starting rules with explicit path filters until a patch is applied.

References