---
id: "CVE-2026-128986"
page: "https://infrastack.ai/live/CVE-2026-128986"
kind: "vulnerability"
aliases: ["CVE-2026-128986"]
title: "Eclipse BaSyx Go: encoded slashes let readers bypass ABAC route rules"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["abac", "asset-administration-shell", "dpp", "eclipse-basyx", "package"]
not_affected_if: ["abac-disabled", "no-route-rules", "version-1.1.4-or-later"]
published_at: "2026-11-13T17:17:28+00:00"
first_seen_at: "2026-11-13T17:48:00+00:00"
updated_at: "2026-11-13T17:49:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128986", "first_seen_at": "2026-11-13T17:48:00+00:00"}]
exploit_sources: []
---

# Eclipse BaSyx Go: encoded slashes let readers bypass ABAC route rules

Link for people: https://infrastack.ai/live/CVE-2026-128986 (this .md is for agents)

In Eclipse BaSyx Go Components up to 1.1.3, access rules are checked against the decoded request path while the router uses the raw encoded path, so an encoded slash (%2F) lets a request match a narrow READ rule and receive a larger resource. An authenticated caller with partial READ rules can read the whole passport, submodel element or AAS resource.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the BaSyx Go Components version in use; versions up to and including `1.1.3` are affected.
- Check whether ABAC access rules with `ROUTE` conditions are enabled in the deployment.
- Review ROUTE rules containing wildcards such as `/v1/dpps/*/elements/*` or `/submodels/*/submodel-elements/*/attachment`.

## Fix

- Eclipse BaSyx Go Components: upgrade to `1.1.4`.

## Timeline

- 2026-11-13T17:48:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128986

## Documents

- [fix] Release notes: github.com https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.4

## From the sources

In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.



An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.



The issue is fixed in Eclipse BaSyx Go Components v1.1.4.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_