An authorization bypass vulnerability in Eclipse Ankaios versions v0.5.1 through v1.0.1 permits authenticated workloads to gain unauthorized read and write access to cluster configurations.

The vulnerability is an incorrect authorization flaw (CWE-863) within the agent-side Control Interface. An authenticated workload can exploit improper evaluation of multi-segment allow rules starting with a wildcard to submit requests that bypass scope restrictions, potentially impacting the entire cluster state.

The exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the containerized environment. An attacker could potentially view sensitive cluster data or modify the configurations of other workloads, leading to privilege escalation or service disruption. With a CVSS score of 8.3, this high-severity issue warrants immediate attention to prevent unauthorized administrative actions within the cluster.

Immediate Action: Upgrade Eclipse Ankaios to version v1.0.2 or later, which contains the necessary security fixes for the Control Interface authorizer.

Proactive Monitoring: Review cluster access logs for anomalous requests or unauthorized attempts to access state information outside of expected workload scopes.

Compensating Controls: If an immediate upgrade is not feasible, modify existing Control Interface allow-rule filter masks to avoid starting with a wildcard; replace them with explicit, granular paths to strictly define authorized access.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for complete cluster state disclosure and modification, administrators should prioritize the transition to version v1.0.2. While the vulnerability requires an authenticated workload to initiate, the impact is severe enough to necessitate prompt patching across all affected Eclipse Ankaios deployments to maintain proper security boundaries.