Eclipse Ankaios wildcard authorization bypass in Control Interface

Eclipse Ankaios versions v0.5.1 through v1.0.1 have an authorization bypass vulnerability where multi-segment allow rules with leading wildcards incorrectly authorize empty field masks, allowing authenticated workloads to access or modify restricted cluster state.

Disclosed 7 September 2026 · Record updated 1 October 2026

Impact

Authenticated workloads could read complete cluster state or replace state outside their authorized scope, potentially causing unauthorized disclosure or modification of other workloads and cluster configuration.

Our coverage

A guard stands at a vast library's entrance, their checklist beginning with a blank asterisk, waving through every visitor who approaches without questioning what they're actually permitted to access inside.

Vulnerabilities

Wildcard rule flaw lets Ankaios workloads read full cluster state

An advisory published on 7 September 2026 says Eclipse Ankaios wrongly authorises empty field masks when an allow rule starts with a wildcard.

14 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-287g-w4gp-cqxr