CVE-2026-92611CWE-1023CWE-863broken-access-control

CVE-2026-92611

published September 17, 2026

CVSS
4.8
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny `LogRule` entries to be skipped and allow unauthorized access to another workload's logs.

The record
Technical detail
CVSS
4.8 · NONE
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00299 · 21.4th percentile
Weaknesses
CWE-1023 · Incomplete Comparison with Missing Factors; CWE-863 · Incorrect Authorization
Published
2026-09-17T15:17Z
References (4)
https://github.com/eclipse-ankaios/ankaios/pull/805 · [email protected]https://github.com/eclipse-ankaios/ankaios/releases/tag/v1.0.4 · [email protected]https://github.com/eclipse-ankaios/ankaios/security/advisories/GHSA-qcqx-hx4v-25rg · [email protected]https://gitlab.eclipse.org/security/cve-assignment/-/work_items/308 · [email protected]
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 10:34Z
    In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single…
    cvelistv5