Описание
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, LogRule::matches in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny LogRule entries to be skipped and allow unauthorized access to another workload's logs.
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, LogRule::matches in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny LogRule entries to be skipped and allow unauthorized access to another workload's logs.
Ссылки
- https://github.com/eclipse-ankaios/ankaios/security/advisories/GHSA-qcqx-hx4v-25rg
- https://nvd.nist.gov/vuln/detail/CVE-2026-92611
- https://github.com/eclipse-ankaios/ankaios/pull/805
- https://github.com/eclipse-ankaios/ankaios/releases/tag/v1.0.4
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/308
Связанные уязвимости
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny `LogRule` entries to be skipped and allow unauthorized access to another workload's logs.