---
id: "CVE-2026-128790"
page: "https://infrastack.ai/live/CVE-2026-128790"
kind: "vulnerability"
aliases: ["CVE-2026-128790"]
title: "Eclipse BaSyx Go: ABAC rules fail to hide Submodel fields on reads"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["aas", "abac", "basyx", "industrial-iot", "runtime", "submodel-repository"]
not_affected_if: ["abac-disabled", "already-on-1.1.3"]
published_at: "2026-11-13T14:17:55+00:00"
first_seen_at: "2026-11-13T15:19:49+00:00"
updated_at: "2026-11-13T15:21:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128790", "first_seen_at": "2026-11-13T15:19:49+00:00"}]
exploit_sources: []
---

# Eclipse BaSyx Go: ABAC rules fail to hide Submodel fields on reads

Link for people: https://infrastack.ai/live/CVE-2026-128790 (this .md is for agents)

In Eclipse BaSyx Go Components up to and including 1.1.2, ABAC-enabled deployments do not apply a rule's FILTERLIST fragment filters to single Submodel reads or to $history routes. An authenticated caller with READ access can therefore see fields and Submodels that the access rules are meant to hide from them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the deployed BaSyx Go Components version against `1.1.2`; anything at or below it is in range.
- Check whether ABAC is enabled in the access rules of the Submodel Repository and AAS Environment.
- Check whether versioning is enabled with `history.mode` set to `api` or `audit`.

## Fix

- Eclipse BaSyx Go Components: move to `1.1.3`.

## Timeline

- 2026-11-13T15:19:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128790

## Documents

- [fix] Release notes: github.com https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.3

## From the sources

In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's `FILTERLIST` fragment filters to single Submodel reads.



`GET /submodels` removes the fields that a rule's `FILTERLIST` hides, but `GET /submodels/{submodelIdentifier}` and `GET /submodels/{submodelIdentifier}/$metadata` return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example `supplementalSemanticIds` keys that name the other parties allowed to read the Submodel.



If versioning is enabled (`history.mode` set to `api` or `audit`), `GET /submodels/{submodelIdentifier}/$history` and `GET /shells/{aasIdentifier}/$history` in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.



The issue is fixed in Eclipse BaSyx Go Components v1.1.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_