CVE-2026-128986: Auth Bypass

Description

In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource. An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`. The issue is fixed in Eclipse BaSyx Go Components v1.1.4.

Is your site exposed to CVE-2026-128986?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-177 CWE-177

CWE-436 CWE-436

CWE-863 Incorrect Authorization

References

Other References

https://github.com/eclipse-basyx/basyx-go-components/pull/888 https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.4 https://gitlab.eclipse.org/security/cve-assignment/-/work_items/582 https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1389

Frequently Asked Questions

What is CVE-2026-128986? +

In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource. An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`. The issue is fixed in Eclipse BaSyx Go Components v1.1.4.

How do I check if I'm vulnerable to CVE-2026-128986? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-23983

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.

CVE-2026-76504 9.8

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to …

CVE-2026-41041 9.1

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. …

CVE-2026-59083 9.1

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. …

CVE-2026-76172 7.5

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and …

CVE-2026-100409 7.5

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware …

CVE-2026-128986