{"id":"CVE-2026-128790","kind":"vulnerability","aliases":["CVE-2026-128790"],"related":[],"title":"Eclipse BaSyx Go: ABAC rules fail to hide Submodel fields on reads","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's `FILTERLIST` fragment filters to single Submodel reads.\n\n\n\n`GET /submodels` removes the fields that a rule's `FILTERLIST` hides, but `GET /submodels/{submodelIdentifier}` and `GET /submodels/{submodelIdentifier}/$metadata` return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example `supplementalSemanticIds` keys that name the other parties allowed to read the Submodel.\n\n\n\nIf versioning is enabled (`history.mode` set to `api` or `audit`), `GET /submodels/{submodelIdentifier}/$history` and `GET /shells/{aasIdentifier}/$history` in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3.","summary":"In Eclipse BaSyx Go Components up to and including 1.1.2, ABAC-enabled deployments do not apply a rule's FILTERLIST fragment filters to single Submodel reads or to $history routes. An authenticated caller with READ access can therefore see fields and Submodels that the access rules are meant to hide from them.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aas","abac","basyx","industrial-iot","runtime","submodel-repository"],"not_affected_if":["abac-disabled","already-on-1.1.3"],"how_to_check":"- Check the deployed BaSyx Go Components version against `1.1.2`; anything at or below it is in range.\n- Check whether ABAC is enabled in the access rules of the Submodel Repository and AAS Environment.\n- Check whether versioning is enabled with `history.mode` set to `api` or `audit`.","fix":"- Eclipse BaSyx Go Components: move to `1.1.3`.","status":"open","published_at":"2026-11-13T14:17:55+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","triaged_at":"2026-11-13T15:21:20+00:00","updated_at":"2026-11-13T15:21:20+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T15:21:20Z","model":"claude-haiku-5-5","output":{"fix":"- Eclipse BaSyx Go Components: move to `1.1.3`.","reach":"network","title":"Eclipse BaSyx Go: ABAC rules fail to hide Submodel fields on reads","impact":"medium","summary":"In Eclipse BaSyx Go Components up to and including 1.1.2, ABAC-enabled deployments do not apply a rule's FILTERLIST fragment filters to single Submodel reads or to $history routes. An authenticated caller with READ access can therefore see fields and Submodels that the access rules are meant to hide from them.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["basyx","aas","industrial-iot","abac","submodel-repository"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated readers see hidden Submodel fields and unauthorized Submodels.","analyst_note":"','product_name':'Eclipse BaSyx Go Components','product_ecosystem':'vendor","how_to_check":"- Check the deployed BaSyx Go Components version against `1.1.2`; anything at or below it is in range.\n- Check whether ABAC is enabled in the access rules of the Submodel Repository and AAS Environment.\n- Check whether versioning is enabled with `history.mode` set to `api` or `audit`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["abac-disabled","already-on-1.1.3"],"who_is_affected":"Deployments that run Eclipse BaSyx Go Components 1.1.2 or earlier with ABAC access rules enabled on the Submodel Repository or AAS Environment. Callers with READ access can see hidden fields through single Submodel reads and $metadata; if history.mode is api or audit, $history routes expose complete stored versions as well. Deployments without ABAC rules, or already on 1.1.3, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001262,"input_tokens":4912,"output_tokens":1541,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128790':15A,18A '-2026':14A,17A '/shells':190C '/submodels':118C,130C,134C,185C '1.1.2':38B,90C 'aa':19B,101C,197C,200C 'aasidentifi':191C 'abac':4A,20B,40B,92C 'abac-en':39B,91C 'access':65B,74B,107C,145C,155C,230C 'administr':237C 'allow':169C 'api':181C 'appli':45B,105C,208C 'asset':236C 'audit':183C 'authent':61B,141C 'basyx':2A,21B,31B,82C,256C 'caller':62B,142C,217C 'complet':204C 'compon':33B,84C,258C 'cve':13A,16A 'deploy':42B,94C 'direct':241C 'eclips':1A,30B,81C,255C 'enabl':41B,93C,177C 'environ':102C,201C 'exampl':161C 'fail':6A 'field':10A,69B,121C,152C,227C 'filter':51B,112C,215C 'filterlist':49B,110C,126C 'fix':253C 'formula':212C 'fragment':50B,111C,214C 'get':117C,129C,133C,184C,189C 'go':3A,32B,83C,257C 'grant':220C 'hide':8A,79B,127C,157C,232C 'histori':58B,187C,192C 'history.mode':178C 'includ':37B,89C 'industri':23B 'industrial-iot':22B 'iot':24B 'issu':251C 'key':163C 'meant':77B 'metadata':136C 'name':165C 'parti':168C 'read':12A,55B,64B,116C,144C,151C,171C,221C,226C,242C 'remov':119C 'repositori':28B,98C,196C,198C 'return':137C,202C,245C 'rout':59B,224C 'rule':5A,47B,75B,108C,124C,156C,210C,219C,231C 'runtim':25B 'see':68B 'set':179C 'shell':238C 'singl':53B,114C 'store':205C 'submodel':9A,27B,54B,71B,97C,115C,148C,173C,195C,234C 'submodel-repositori':26B 'submodelidentifi':131C,135C,186C 'supplementalsemanticid':162C 'therefor':67B,150C 'unfilt':139C 'v1.1.3':259C 'version':85C,175C,206C 'whose':218C 'without':207C","nicknames":[],"mitigations":[],"who_affected":"Deployments that run Eclipse BaSyx Go Components 1.1.2 or earlier with ABAC access rules enabled on the Submodel Repository or AAS Environment. Callers with READ access can see hidden fields through single Submodel reads and $metadata; if history.mode is api or audit, $history routes expose complete stored versions as well. Deployments without ABAC rules, or already on 1.1.3, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aas","abac","basyx","high","industrialiot","runtime","submodelrepository"],"campaign_type":null,"search_a":"'-128790':15A,18A '-2026':14A,17A 'abac':4A 'basyx':2A 'cve':13A,16A 'eclips':1A 'fail':6A 'field':10A 'go':3A 'hide':8A 'read':12A 'rule':5A 'submodel':9A","search_b":"'1.1.2':38B 'aa':19B 'abac':20B,40B 'abac-en':39B 'access':65B,74B 'appli':45B 'authent':61B 'basyx':21B,31B 'caller':62B 'compon':33B 'deploy':42B 'eclips':30B 'enabl':41B 'field':69B 'filter':51B 'filterlist':49B 'fragment':50B 'go':32B 'hide':79B 'histori':58B 'includ':37B 'industri':23B 'industrial-iot':22B 'iot':24B 'meant':77B 'read':55B,64B 'repositori':28B 'rout':59B 'rule':47B,75B 'runtim':25B 'see':68B 'singl':53B 'submodel':27B,54B,71B 'submodel-repositori':26B 'therefor':67B","search_c":"'/shells':190C '/submodels':118C,130C,134C,185C '1.1.2':90C 'aa':101C,197C,200C 'aasidentifi':191C 'abac':92C 'abac-en':91C 'access':107C,145C,155C,230C 'administr':237C 'allow':169C 'api':181C 'appli':105C,208C 'asset':236C 'audit':183C 'authent':141C 'basyx':82C,256C 'caller':142C,217C 'complet':204C 'compon':84C,258C 'deploy':94C 'direct':241C 'eclips':81C,255C 'enabl':93C,177C 'environ':102C,201C 'exampl':161C 'field':121C,152C,227C 'filter':112C,215C 'filterlist':110C,126C 'fix':253C 'formula':212C 'fragment':111C,214C 'get':117C,129C,133C,184C,189C 'go':83C,257C 'grant':220C 'hide':127C,157C,232C 'histori':187C,192C 'history.mode':178C 'includ':89C 'issu':251C 'key':163C 'metadata':136C 'name':165C 'parti':168C 'read':116C,144C,151C,171C,221C,226C,242C 'remov':119C 'repositori':98C,196C,198C 'return':137C,202C,245C 'rout':224C 'rule':108C,124C,156C,210C,219C,231C 'set':179C 'shell':238C 'singl':114C 'store':205C 'submodel':97C,115C,148C,173C,195C,234C 'submodelidentifi':131C,135C,186C 'supplementalsemanticid':162C 'therefor':150C 'unfilt':139C 'v1.1.3':259C 'version':85C,175C,206C 'whose':218C 'without':207C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128790","severity":null,"published_at":"2026-11-13T14:17:55+00:00","modified_at":"2026-11-13T14:17:55+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","fetched_at":"2026-11-13T15:19:49+00:00","note":null}],"documents":[{"id":147086,"url":"https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}