CVE-2026-80515

Eclipse Arrowhead 5.0.0 through 5.2.1 contains an authorization flaw (CWE-647/CWE-863) in the gate that protects every /…/mgmt/… REST endpoint, which decides whether to enforce its check using a substring test against the un-decoded request URL. Because Tomcat's getRequestURL() returns the URL un-decoded while Spring MVC dispatches on the decoded path, a request such as /serviceregistry/%6Dgmt/systems (percent-encoded 'm') skips the authorization check yet still reaches the management controller, and the bundled StrictHttpFirewall only rejects encoded /, \, ., %, ; and null bytes, so percent-encoded ASCII letters pass through. Any authenticated system, regardless of its assigned privileges, can therefore invoke every management operation, including POST /authentication/mgmt/identities, which creates new sysop accounts and yields full administrative takeover of the local cloud. All deployments of the affected Eclipse Arrowhead versions that expose the management REST API to authenticated participants are affected. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists at this time, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade all Arrowhead core systems to a release beyond 5.2.1 (first fixed version not stated in the supplied data) and, as an interim mitigation, restrict /…/mgmt/… endpoints to trusted clients at a reverse proxy or tighten the StrictHttpFirewall to reject percent-encoded letters on management paths. Audit local sysop accounts for entries created without authorization, since any low-privilege authenticated system could have minted sysop accounts via POST /authentication/mgmt/identities.