CVE-2026-80515
Received Received - Intake

Path Traversal in Eclipse Arrowhead Management Gate

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Eclipse Foundation

Description
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat returns getRequestURL() un-decoded, while Spring MVC's DispatcherServlet routes on the decoded path. Requesting /serviceregistry/%6Dgmt/systems (%6D == m) therefore fails the substring check — the filter falls through without authorising — yet is decoded to /serviceregistry/mgmt/systems and dispatched to the management controller. Spring Security's StrictHttpFirewall (active via spring-boot-starter-security in arrowhead-common) only rejects encoded / \ . % ; and null bytes, so percent-encoded ASCII letters pass through. Any authenticated system — regardless of privilege — can reach every management operation, including POST /authentication/mgmt/identities which creates new sysop accounts, yielding full administrative takeover of the local cloud.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-80515
EUVD
EUVD-2026-70470

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
eclipse arrowhead From 5.0.0 (inc) to 5.2.1 (inc)
spring boot_starter_security *
spring security *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-647 The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-80515 is a management-authorization bypass in Eclipse Arrowhead versions 5.0.0 to 5.2.1. The vulnerability allows authenticated attackers to bypass authorization checks on management endpoints by using percent-encoded path segments like /serviceregistry/%6Dgmt/systems (%6D equals 'm'). The issue occurs because the authorization filter checks the raw, un-decoded URL for '/mgmt/' while Spring MVC routes based on the decoded path. This mismatch lets attackers access restricted management operations, including creating admin accounts.

Detection Guidance

Check for unauthorized access attempts to management endpoints by monitoring logs for requests containing percent-encoded paths like /%6Dgmt/ or similar bypass patterns. Inspect network traffic for requests to /serviceregistry/%6Dgmt/systems or other /mgmt/ endpoints with encoded segments.

Impact Analysis

An attacker can gain full administrative control over the local Arrowhead cloud environment. This includes creating sysop accounts with highest privileges, accessing all management operations, and potentially compromising all five core Arrowhead systems (ServiceRegistry, Authentication, ConsumerAuthorization, ServiceOrchestration). The attack requires either a valid system identity or just setting an HTTP header in default configurations.

Mitigation Strategies

Update Eclipse Arrowhead to a patched version beyond 5.2.1. If immediate patching is not possible, restrict access to management endpoints via network firewalls or reverse proxies. Review and modify authorization filters to use decoded paths for checks instead of raw URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80515. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart