CVE-2026-80515: eclipse foundation eclipse arrowhead

Vulnerability summary

CVE-2026-80515 is a high (CVSS 8.9) vulnerability in eclipse foundation eclipse arrowhead. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.2% of scored vulnerabilities.

Timeline

1. 03-09-2026
   PublishedVulnerability first disclosed.
2. 03-09-2026
   Last modifiedVulnerability information updated.

Description

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat returns getRequestURL() un-decoded, while Spring MVC's DispatcherServlet routes on the decoded path. Requesting /serviceregistry/%6Dgmt/systems (%6D == m) therefore fails the substring check — the filter falls through without authorising — yet is decoded to /serviceregistry/mgmt/systems and dispatched to the management controller. Spring Security's StrictHttpFirewall (active via spring-boot-starter-security in arrowhead-common) only rejects encoded / \ . % ; and null bytes, so percent-encoded ASCII letters pass through. Any authenticated system — regardless of privilege — can reach every management operation, including POST /authentication/mgmt/identities which creates new sysop accounts, yielding full administrative takeover of the local cloud.

• CWE-647Use of Non-Canonical URL Paths for Authorization DecisionsThe product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.