CVE-2026-80515

HighCVSS 8.9

Published: 03/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Summary

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1, the management-authorization gate protecting every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat returns getRequestURL() un-decoded, while Spring MVC's DispatcherServlet routes on the decoded path. Requesting /serviceregistry/%6Dgmt/systems (%6D == m) fails the substring check but is decoded to /serviceregistry/mgmt/systems and dispatched to the management controller. Any authenticated system can reach every management operation, including creating sysop accounts, leading to full administrative takeover of the local cloud.

Risk Assessment

Risk of full takeover of the local cloud by any authenticated user, including creation of administrator accounts.

Recommendation

Update Eclipse Arrowhead to a version newer than 5.2.1, which includes the fix.

Other vulnerabilities in Eclipse Arrowhead

CVE-2026-82180Critical
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload and treats its Subject DN as the authenticated identity. The certificate is decoded but its signature is never verified and its issuer chain is never validated against any trust store. An attacker who can publish to the MQTT broker can mint a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op to gain full management access over MQTT.

Original NVD description (English source)

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat returns getRequestURL() un-decoded, while Spring MVC's DispatcherServlet routes on the decoded path. Requesting /serviceregistry/%6Dgmt/systems (%6D == m) therefore fails the substring check — the filter falls through without authorising — yet is decoded to /serviceregistry/mgmt/systems and dispatched to the management controller. Spring Security's StrictHttpFirewall (active via spring-boot-starter-security in arrowhead-common) only rejects encoded / \ . % ; and null bytes, so percent-encoded ASCII letters pass through. Any authenticated system — regardless of privilege — can reach every management operation, including POST /authentication/mgmt/identities which creates new sysop accounts, yielding full administrative takeover of the local cloud.