Eclipse Arrowhead EUVD-2026-70470

The attacker must hold a valid credential enrolled in the target Arrowhead local cloud - specifically, a client certificate or equivalent authentication token accepted by the Spring Security layer (PR:L in CVSS 4.0). No elevated or administrative rights are required; any enrolled system principal suffices. The attack path is over the network (AV:N) and requires no user interaction. The encoding bypass (percent-encoding any single ASCII letter in the '/mgmt/' path segment) is the only technical step beyond standard HTTP request construction. Exploitation is limited to Arrowhead deployments running versions 5.0.0-5.2.1; deployments that additionally restrict /mgmt/ endpoints at the network or reverse-proxy layer are partially protected. No special server configuration is required - the vulnerable code path is active in the default installation.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H, score 8.9) accurately captures the core risk profile. AT:P (Attack Requirements: Present) reflects that the attacker must hold valid credentials as an enrolled Arrowhead system - a meaningful prerequisite in the Arrowhead PKI-based trust model, but not a high bar once an attacker has compromised or enrolled any legitimate system. PR:L is correct; no elevated rights beyond standard enrollment are needed. The scope-change to subsequent systems (SC:H/SI:H/SA:H) is the most consequential signal: the ability to POST /authentication/mgmt/identities escalates a low-privilege system principal to full sysop status, from which every other resource in the local cloud is controllable. Availability impact on the vulnerable system (VC/VA:N) is assessed as not directly applicable - the exploit does not crash or disrupt the service, only silently bypasses its authorization. No KEV listing, no EPSS data, and no public POC are present in the input; real-world exploitation probability is therefore inferred from CVSS metrics alone and should be treated as elevated given the trivial encoding step required. The encoding bypass requires no tooling beyond a standard HTTP client.

An attacker who controls or has compromised any enrolled Arrowhead system (holding a valid client certificate) sends a crafted HTTP POST to /authentication/%6Dgmt/identities - the management endpoint that creates new sysop accounts. The authorization filter, evaluating the raw Tomcat URL, sees no '/mgmt/' substring and allows the request through unauthenticated; Spring MVC decodes the path and dispatches it to the management controller, which creates a new sysop-level identity under the attacker's control. The attacker then uses the new sysop credentials to access, modify, or exfiltrate configuration for every service in the local cloud.