Eclipse Ankaios CVE-2026-84173

Exploitation requires two concurrent conditions: (1) the attacker controls an authenticated workload that has been granted Control Interface access (PR:H - not an unauthenticated scenario), and (2) that workload's allow rule is a multi-segment path whose first segment is a wildcard (e.g., *.workloads.some_workload or similar). Deployments that use only fully explicit path rules (e.g., desiredState.workloads.some_workload) or only the bare * wildcard are not affected. Exploitation is further limited to the local agent boundary (AV:L); no remote network path is involved. The attack does not require user interaction or additional privileges beyond the workload's own Control Interface credentials.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) yields a score of 8.3, reflecting high confidentiality and integrity impact but local attack surface and high privilege requirement. Real-world risk is meaningfully constrained: exploitation requires (1) the attacker to control an authenticated workload with Control Interface access, and (2) an operator to have deployed multi-segment allow rules beginning with a wildcard - a non-default, specific misconfiguration the vendor now explicitly warns against. The vendor's AT:N (no attack requirements) appears optimistic given this configuration dependency; AT:P would more accurately reflect the situational prerequisite. No EPSS data, KEV listing, or public exploit is available, further limiting urgency outside environments already using wildcard-prefixed rules. The integrity impact (VI:H) is the more concerning axis: a compromised workload could overwrite cluster state affecting other workloads and their configuration, making this a meaningful lateral-movement risk in multi-tenant Ankaios deployments.

A workload with a nominally scoped Control Interface allow rule such as *.workloads.my_service sends a CompleteStateRequest or UpdateStateRequest with an intentionally empty field mask. The agent-side authorizer incorrectly interprets the empty mask as matching the wildcard-prefixed rule, and the workload receives the full cluster state - including configuration and secrets of unrelated workloads - or overwrites state across the entire cluster beyond its authorized subtree. No exploit tooling is publicly known; the attack is straightforward to craft by any workload operator aware of the logic flaw.