Local Privilege Escalation Vulnerability in Eclipse Ankaios by Eclipse

CVE-2026-86836

What is CVE-2026-86836?

Eclipse Ankaios versions 0.1.0 through 1.0.2 are vulnerable due to the agent's predictable path for creating workload files and Control Interface FIFOs. Without proper validation of the file's owner or permissions, a local, unprivileged user with write access can create a path hierarchy. This allows the agent to mistakenly accept attacker-owned FIFOs as legitimate, enabling impersonation of the workload. Consequently, an attacker may exploit this to gain unauthorized access, manipulating the cluster's state based on the permissions configured for the targeted workload.

References