Unauthorized Log Access via Wildcard Skipping in Eclipse Ankaios 0.6.0-1.0.4
CVE-2026-92611 Published on September 17, 2026
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny `LogRule` entries to be skipped and allow unauthorized access to another workload's logs.
Vulnerability Analysis
CVE-2026-92611 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-92611 has been classified to as an AuthZ vulnerability or weakness.
Incomplete Comparison with Missing Factors
The software performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors. An incomplete comparison can lead to resultant weaknesses, e.g., by operating on the wrong object or making a security decision without considering a required factor.
Affected Versions
Eclipse Foundation Eclipse Ankaios:- Version 0.6.0 and below 1.0.4 is affected.