Medium severity · published Sep 17, 2026
CVE-2026-92611
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of…
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny `LogRule` entries to be skipped and allow unauthorized access to another workload's logs.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Eclipse Ankaios · Eclipse Foundation
0.6.0 before 1.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92611
github.com
https://github.com/eclipse-ankaios/ankaios/pull/805
github.com
https://github.com/eclipse-ankaios/ankaios/releases/tag/v1.0.4
github.com
https://github.com/eclipse-ankaios/ankaios/security/advisories/GHSA-qcqx-hx4v-25rg
gitlab.eclipse.org
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/308
More from Eclipse Ankaios
8.4
CVE-2026-86836
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name…
8.3
CVE-2026-84173
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a…
6.8
CVE-2026-85201
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control…