CVE-2026-92611
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny `LogRule` entries to be skipped and allow unauthorized access to another workload's logs.
Risk Assessment
An unauthorized user can access logs of other workloads, potentially exposing sensitive operational information.
Recommendation
Update Eclipse Ankaios to version 1.0.4 or later, which includes the fix.
Other vulnerabilities in Eclipse Ankaios
See all- CVE-2026-86836High
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface FIFOs under a predictable path derived from the agent name and a hash of the workload configuration. If the path already exists at agent startup, it is reused without validating owner or permissions, allowing a local user to impersonate the workload and modify cluster state.
- CVE-2026-85201Medium
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload with Control Interface access can specify an excessive message length, causing unbounded memory allocation that may abort the agent process, resulting in loss of orchestration services.
- CVE-2026-84173High
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with restricted access can submit a CompleteStateRequest or UpdateStateRequest with an empty field mask, which may be incorrectly authorized, allowing read of the complete cluster state or modification outside its authorized subtree.
Original NVD description (English source)
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny `LogRule` entries to be skipped and allow unauthorized access to another workload's logs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS