CVE-2026-128986 · Package
NO FIX YET · SEE WHAT TO DO
In Eclipse BaSyx Go Components up to 1.1.3, access rules are checked against the decoded request path while the router uses the raw encoded path, so an encoded slash (%2F) lets a request match a narrow READ rule and receive a larger resource. An authenticated caller with partial READ rules can read the whole passport, submodel element or AAS resource.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments running Eclipse BaSyx Go Components up to and including 1.1.3 with ABAC enabled and ROUTE access rules that use wildcards. Callers must already be authenticated, and the flaw lets them read more than their rules grant. Systems without ABAC ROUTE rules are not affected by this path.
Not affected if abac-disabled, no-route-rules, version-1.1.4-or-later
Who cares abac, asset-administration-shell, dpp, eclipse-basyx
1.1.3 are affected.ROUTE conditions are enabled in the deployment./v1/dpps/*/elements/* or /submodels/*/submodel-elements/*/attachment.1.1.4.In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match ROUTE access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (%2F) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow ROUTE rule while the handler returns a different, larger resource.
An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as /v1/dpps/*/elements/*, meant to grant only passport elements, also grants the complete passport whose identifier contains /elements/. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as /submodels/*/submodel-elements/*/attachment, meant to grant only file attachments, also grants the complete element whose stored idShort contains %2F.
The issue is fixed in Eclipse BaSyx Go Components v1.1.4.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.