{"id":"CVE-2026-128986","kind":"vulnerability","aliases":["CVE-2026-128986"],"related":[],"title":"Eclipse BaSyx Go: encoded slashes let readers bypass ABAC route rules","description":"In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.\n\n\n\nAn authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.4.","summary":"In Eclipse BaSyx Go Components up to 1.1.3, access rules are checked against the decoded request path while the router uses the raw encoded path, so an encoded slash (%2F) lets a request match a narrow READ rule and receive a larger resource. An authenticated caller with partial READ rules can read the whole passport, submodel element or AAS resource.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abac","asset-administration-shell","dpp","eclipse-basyx","package"],"not_affected_if":["abac-disabled","no-route-rules","version-1.1.4-or-later"],"how_to_check":"- Check the BaSyx Go Components version in use; versions up to and including `1.1.3` are affected.\n- Check whether ABAC access rules with `ROUTE` conditions are enabled in the deployment.\n- Review ROUTE rules containing wildcards such as `/v1/dpps/*/elements/*` or `/submodels/*/submodel-elements/*/attachment`.","fix":"- Eclipse BaSyx Go Components: upgrade to `1.1.4`.","status":"open","published_at":"2026-11-13T17:17:28+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","triaged_at":"2026-11-13T17:49:07+00:00","updated_at":"2026-11-13T17:49:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T17:49:07Z","model":"claude-haiku-5-5","output":{"fix":"- Eclipse BaSyx Go Components: upgrade to `1.1.4`.","reach":"network","title":"Eclipse BaSyx Go: encoded slashes let readers bypass ABAC route rules","impact":"medium","summary":"In Eclipse BaSyx Go Components up to 1.1.3, access rules are checked against the decoded request path while the router uses the raw encoded path, so an encoded slash (%2F) lets a request match a narrow READ rule and receive a larger resource. An authenticated caller with partial READ rules can read the whole passport, submodel element or AAS resource.","audience":"businesses","category":"package","nicknames":[],"who_cares":["eclipse-basyx","asset-administration-shell","abac","dpp"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated callers read whole passports or resources beyond their rules","analyst_note":"","how_to_check":"- Check the BaSyx Go Components version in use; versions up to and including `1.1.3` are affected.\n- Check whether ABAC access rules with `ROUTE` conditions are enabled in the deployment.\n- Review ROUTE rules containing wildcards such as `/v1/dpps/*/elements/*` or `/submodels/*/submodel-elements/*/attachment`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["abac-disabled","no-route-rules","version-1.1.4-or-later"],"who_is_affected":"Deployments running Eclipse BaSyx Go Components up to and including 1.1.3 with ABAC enabled and ROUTE access rules that use wildcards. Callers must already be authenticated, and the flaw lets them read more than their rules grant. Systems without ABAC ROUTE rules are not affected by this path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000822,"input_tokens":4832,"output_tokens":678,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128986':14A,17A '-2026':13A,16A '/attachment':223C '/elements':192C,207C '/submodel-elements':222C '/submodels':221C '/v1/dpps':191C '1.1.3':35B,98C '2f':57B,126C,239C 'aa':86B,212C,215C 'abac':9A,18B,100C 'abac-en':99C 'access':36B,105C,137C 'administr':21B 'also':199C,230C 'api':186C 'asset':20B 'asset-administration-shel':19B 'attach':229C 'authent':72B,165C 'basyx':2A,26B,30B,90C,246C 'bypass':8A 'caller':73B,166C 'check':39B,138C 'complet':202C,233C 'compon':32B,92C,248C 'contain':206C,238C 'cve':12A,15A 'decod':42B,110C 'deploy':102C 'differ':161C 'dpp':23B,185C 'eclips':1A,25B,29B,89C,245C 'eclipse-basyx':24B 'element':84B,198C,234C 'enabl':101C 'encod':4A,51B,55B,121C,124C 'environ':216C 'file':228C 'fix':243C 'fulli':109C 'go':3A,31B,91C,247C 'grant':169C,195C,200C,226C,231C 'handler':158C 'identifi':205C 'idshort':237C 'includ':97C 'insid':127C 'issu':241C 'larger':69B,162C 'let':6A,58B 'match':61B,103C,151C 'meant':193C,224C 'narrow':63B,153C 'packag':27B 'part':140C,173C 'partial':75B 'passport':82B,197C,203C 'path':44B,52B,112C,122C,129C 'raw':50B,119C 'read':64B,76B,79B,170C,179C 'reader':7A 'receiv':67B 'repositori':211C,213C 'request':43B,60B,111C,149C 'resourc':70B,87B,163C,176C,182C 'return':159C 'rout':10A,104C,116C,154C 'router':47B,115C,146C 'rule':11A,37B,65B,77B,106C,155C,168C,188C,218C 'segment':133C 'separ':134C 'shell':22B 'slash':5A,56B,125C 'still':120C 'store':236C 'submodel':83B,210C 'therefor':178C 'use':48B 'v1.1.4':249C 'valu':130C,143C 'version':93C 'whole':81B,181C 'whose':167C,204C,235C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Eclipse BaSyx Go Components up to and including 1.1.3 with ABAC enabled and ROUTE access rules that use wildcards. Callers must already be authenticated, and the flaw lets them read more than their rules grant. Systems without ABAC ROUTE rules are not affected by this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["abac","assetadministrationshell","dpp","eclipsebasyx","medium","package"],"campaign_type":null,"search_a":"'-128986':14A,17A '-2026':13A,16A 'abac':9A 'basyx':2A 'bypass':8A 'cve':12A,15A 'eclips':1A 'encod':4A 'go':3A 'let':6A 'reader':7A 'rout':10A 'rule':11A 'slash':5A","search_b":"'1.1.3':35B '2f':57B 'aa':86B 'abac':18B 'access':36B 'administr':21B 'asset':20B 'asset-administration-shel':19B 'authent':72B 'basyx':26B,30B 'caller':73B 'check':39B 'compon':32B 'decod':42B 'dpp':23B 'eclips':25B,29B 'eclipse-basyx':24B 'element':84B 'encod':51B,55B 'go':31B 'larger':69B 'let':58B 'match':61B 'narrow':63B 'packag':27B 'partial':75B 'passport':82B 'path':44B,52B 'raw':50B 'read':64B,76B,79B 'receiv':67B 'request':43B,60B 'resourc':70B,87B 'router':47B 'rule':37B,65B,77B 'shell':22B 'slash':56B 'submodel':83B 'use':48B 'whole':81B","search_c":"'/attachment':223C '/elements':192C,207C '/submodel-elements':222C '/submodels':221C '/v1/dpps':191C '1.1.3':98C '2f':126C,239C 'aa':212C,215C 'abac':100C 'abac-en':99C 'access':105C,137C 'also':199C,230C 'api':186C 'attach':229C 'authent':165C 'basyx':90C,246C 'caller':166C 'check':138C 'complet':202C,233C 'compon':92C,248C 'contain':206C,238C 'decod':110C 'deploy':102C 'differ':161C 'dpp':185C 'eclips':89C,245C 'element':198C,234C 'enabl':101C 'encod':121C,124C 'environ':216C 'file':228C 'fix':243C 'fulli':109C 'go':91C,247C 'grant':169C,195C,200C,226C,231C 'handler':158C 'identifi':205C 'idshort':237C 'includ':97C 'insid':127C 'issu':241C 'larger':162C 'match':103C,151C 'meant':193C,224C 'narrow':153C 'part':140C,173C 'passport':197C,203C 'path':112C,122C,129C 'raw':119C 'read':170C,179C 'repositori':211C,213C 'request':111C,149C 'resourc':163C,176C,182C 'return':159C 'rout':104C,116C,154C 'router':115C,146C 'rule':106C,155C,168C,188C,218C 'segment':133C 'separ':134C 'slash':125C 'still':120C 'store':236C 'submodel':210C 'therefor':178C 'v1.1.4':249C 'valu':130C,143C 'version':93C 'whole':181C 'whose':167C,204C,235C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T17:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128986","severity":null,"published_at":"2026-11-13T17:17:28+00:00","modified_at":"2026-11-13T17:17:28+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","fetched_at":"2026-11-13T17:48:00+00:00","note":null}],"documents":[{"id":148074,"url":"https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}