Eclipse Ankaios versions 0.1.0 through 1.0.2 are vulnerable to a local workload impersonation attack that can lead to unauthorized cluster state modifications.

The agent insecurely creates and reuses Control Interface named pipes (FIFOs) using predictable paths without validating ownership or permissions. An authenticated local user can pre-create these paths to intercept the interface handshake, effectively impersonating a workload to perform unauthorized operations.

Successful exploitation allows a local user to gain the permissions assigned to a legitimate workload, which may include the ability to read or modify the desired state of the entire cluster. Given the CVSS score of 8.4, this represents a significant security risk for environments where multi-tenancy or shared local access exists, as it enables lateral movement and privilege escalation within the orchestration layer.

Immediate Action: Upgrade to Eclipse Ankaios version 1.0.3 or later, which addresses the insecure path handling and permission validation.

Proactive Monitoring: Audit logs for suspicious file system activity within the /tmp/ankaios directory or other configured base directories where workload FIFOs are stored.

Compensating Controls: Restrict local shell access for untrusted users on systems running Ankaios agents and ensure that the agent process is run with the least privilege necessary to prevent broader system compromise.

Public Exploit Available: No (exploit_available: false)

The vulnerability poses a high risk to cluster integrity by allowing workload impersonation. Administrators should prioritize updating to version 1.0.3 immediately to secure the Control Interface communication and prevent local users from hijacking workload privileges.