CVE-2026-85199

Executive Summary

CVE-2026-85199 is a path traversal vulnerability (CWE-22) in Eclipse aeriOS Self-orchestrator versions prior to 1.2.1. The flaw resides in the REST API, where user-controlled resource identifiers are concatenated into filesystem paths without proper validation, allowing an unauthenticated remote attacker to write or delete arbitrary JSON files via crafted path traversal sequences (../). Exploitation is amplified by the absence of authentication on the affected endpoints and a container deployment configuration that grants elevated privileges, potentially allowing writes to sensitive host directories. The issue is remediated in version 1.2.1 with identifier sanitization. No patch evidence, public exploit code, or CISA KEV listing exists at the time of writing.

Technical Analysis

Vulnerability Mechanism

The root cause is a classic path traversal flaw (CWE-22) in the Self-orchestrator REST API. Based strictly on the NVD description, the API accepts user-controlled identifiers that are used to construct filesystem paths for create, update, and delete operations on Self-orchestrator resources. These identifiers were incorporated into paths without adequate validation, meaning an attacker could inject platform-specific path traversal sequences — e.g., ../, ..\\, or URL-encoded equivalents (%2e%2e%2f) — to escape the designated application data directory.

The affected operations persist state as JSON files, so the vulnerability enables two primary primitives:

1. Arbitrary JSON file write: By supplying an identifier like ../../../../tmp/evil, an attacker can cause the application to create or overwrite a JSON file at an attacker-chosen location.
2. Arbitrary JSON file delete: Similarly, a DELETE request with a traversed identifier can remove files outside the intended sandbox.

Attack Surface

• Exposure: The API is accessible over the network and lacks authentication on the affected endpoints. This is explicitly noted in the NVD description, meaning no credentials are required to trigger the flaw.
• Privilege context: The description indicates the container is deployed with elevated privileges in the affected configuration. This elevates the impact, as the process likely runs as root or with extended capabilities (e.g., --privileged, host PID/IPC namespace, or bind mounts), potentially granting write/delete access to paths beyond the container's local filesystem — including mounted host volumes.
• Operation types: The flaw applies to create, update, and delete operations, giving attackers full CRUD-style control over JSON artifacts.
• Constraint: The impact is limited to JSON file operations; the description does not indicate the ability to write non-JSON content or achieve code execution directly via this path traversal (e.g., no mention of writing scripts, config overrides, or cron files — although writing JSON into certain system directories could have indirect effects, such as overwriting application configuration files).

Absence of Authentication

The lack of authentication on the API removes the attacker's need to compromise valid credentials or session tokens. Any host or network segment able to reach the Self-orchestrator API port is a legitimate target surface. This turns the vulnerability into a trivial remote attack irrespective of identity — combining the path traversal with permissive network access.

Service and Version Context

No precise list of affected versions is supplied beyond "prior to 1.2.1". Patch confidence is rated 0/4, indicating no trusted patch diff or advisory URL is available from tracked sources. This is unusual — the fix exists in 1.2.1 per the NVD description, but the source advisory artifacts are not available in the intelligence feed. Analysts should treat the fix as vendor-provided but unverified until an official Eclipse advisory is published.

Exploitation Scenarios

No public PoC exists; the attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance / Target Identification

An attacker first identifies a reachable Self-orchestrator API instance. The service is network-exposed and unauthenticated, so active scanning (e.g., port scans for common API ports such as 8080, 8443, or 9090) can locate candidate hosts. Shodan/Censys queries for banners or HTTP responses characteristic of Eclipse aerIOS may surface internet-facing instances. Alternatively, internal network enumeration (if the attacker has foothold) targeting container networks would reveal the service.

Step 2 — Triggering the Flaw

The attacker crafts API requests (POST/PUT for create/update, DELETE for removal) targeting Self-orchestrator resources. The resource identifier is the user-controlled parameter that flows into the filesystem path concatenation. Because no authentication is required, no session acquisition is needed — the attacker simply issues an HTTP request with a modified path/body parameter.

Step 3 — Payload / Execution Method

The payload is a path traversal sequence embedded in the identifier field. Example at the class level:

POST /api/resources/../../../../tmp/backdoor.json
Content-Type: application/json

{"payload":"attacker-controlled"}

The web framework may normalize or reject such sequences unless URL-encoded. An attacker would likely use encoded forms: ..%2f or double-encoding (..%252f) to bypass naive filters (though details of any middleware filter are unavailable in the source data). The traversal mechanism is OS-dependent — Linux/Unix systems use /, Windows systems use \ — and the exact separator depends on the deployment OS.

Valid example — write primitive:

• Identifier: ../../../../var/lib/aeriOS/persisted_state.json

• Result: Overwrites an existing JSON state file with attacker content — potentially corrupting Self-orchestrator configuration or injecting bogus orchestration directives that later get honored by the orchestrator runtime upon next read.

• Identifier: ../../../../home/aeriOS_user/.ssh/authorized_keys_backup.json — writes a new file, but content is constrained to JSON (the portion after the identifier must parse as the application serializes its internal resource model; however, an attacker who controls the body of a create/update request may control which JSON keys/values are embedded, potentially including newlines/other separators if the application writes raw JSON text without escaping).

Valid example — delete primitive:

• Identifier: ../../../etc/nginx/sites-enabled/default.json
• Result: Deletes an arbitrary user-writable JSON file. Deleting application state or orchestration configuration can cause denial of service or state corruption. If the process runs with elevated host privileges, it may delete files outside the container entirely.

Step 4 — Post-Exploitation Impact

• State corruption / DoS: By overwriting or deleting resource JSON files, an attacker can break the orchestrator's ability to read, persist, or reconcile self-orchestrated workloads, causing container orchestration failures.
• Privilege escalation (conditional): With elevated container privileges, writing to host-mapped volumes may allow the attacker to drop files onto the host filesystem. If the attacker can write a JSON file that is loaded as an application configuration or service definition, they may cause the host-side agent or orchestrator to perform privileged actions (e.g., pulling a malicious image, restarting a service).
• File disclosure (limited): The delete primitive discloses path existence (error vs. success), and the create/update primitive may leak whether a target path is writable, giving the attacker a file-system topology oracle.
• No direct RCE: The JSON-only write constraint and absence of details about interpretation of written contents limit the impact to state/file manipulation — remote code execution would require a secondary flaw that interprets attacker-written JSON in a dangerous way (e.g., config-driven templating/pickle). This is not established in the source data.

Impact Assessment

Business Impact

Blast Radius

• Directly affected: Any deployment of Self-orchestrator < 1.2.1 with the API reachable on the network — includes containerized or bare-metal instances.
• Indirectly affected: Hosts sharing mounted volumes with the container may suffer file destruction or planted JSON configuration. Downstream workloads orchestrated by the compromised instance may behave unpredictably.
• Credential exposure: None — flaw does not involve secrets management, but forensic analysis may reveal attacker-planted JSON files containing context on orchestration internals.

CVSS Context

CVSS was not provided by the vendor/CNA. Based on the vector characteristics (network, low complexity, no auth, partial impact — integrity/availability elevated by privileged execution), a realistic estimated score would fall in the 7.5–9.8 range (High–Critical). However, actual CVSS is N/A and should be treated as unassigned until the Eclipse security advisory publishes scoring.

Detection Guidance

Sigma Rule

title: Potential Path Traversal in Eclipse aeriOS Self-orchestrator REST API
id: 5f2c9b1a-3c41-4a6e-9b8f-2e6a3d9c7f31
status: experimental
description: Detects HTTP requests to Self-orchestrator API containing path traversal sequences in resource identifiers, suggesting CVE-2026-85199 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85199
author: Valters IT Security Research
date: 2026/06/15
logsource:
    category: webserver
    product: generic
detection:
    selection_main:
        cs-method:
            - 'POST'
            - 'PUT'
            - 'DELETE'
        cs-uri-query|contains:
            - '..%2f'
            - '..%252f'
            - '%2e%2e%2f'
            - '%252e%252e%252f'
        cs-uri-query|re:
            - '\.\.(/|\\)'
            - '\.\.%2f'
    selection_extended:
        cs-uri-stem|contains:
            - 'api'
            - 'self-orchestrator'
            - 'orchestrator'
    condition: selection_main and selection_extended
    timeframe: 5m
level: high
falsepositives:
    - Legitimate applications may use encoded traversal in file-download features (rare)
    - Existing URL-rewriting proxies might encode paths
tags:
    - attack.t1190
    - attack.t1083
    - cve.2026.85199

YARA Rule

rule CVE_2026_85199_PathTraversal_URI {
    meta:
        author = "Valters IT Security Research"
        date = "2026-06-15"
        description = "Detects URL path traversal patterns targeting Eclipse aerIOS Self-orchestrator REST API in web server logs or request payloads"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85199"
        cve = "CVE-2026-85199"
        severity = "high"

    strings:
        $traversal_slash = /(?:\.\.\/){2,}/ nocase
        $traversal_back = /(?:\.\.\\){2,}/ nocase
        $encoded_dot = "%2e%2e%2f" nocase
        $double_encoded = "%252e%252e%252f" nocase
        $api_keyword = "self-orchestrator" nocase
        $orchestrator_keyword = "orchestrator" nocase
        $method_post = "POST " ascii
        $method_delete = "DELETE " ascii
        $method_put = "PUT " ascii
        $json_ext = ".json" ascii nocase
        $delete_op = "delete" ascii nocase

    condition:
        (uint16(0) == 0x0d0a or filesize < 10KB) and
        (
            (1 of ($traversal_*)) or
            (1 of ($encoded_*)) or
            ($double_encoded)
        ) and
        (
            (1 of ($api_keyword, $orchestrator_keyword)) or
            (1 of ($method_post, $method_delete, $method_put) and $json_ext)
        )
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Eclipse aerIOS Self-orchestrator Path Traversal Attempt (CVE-2026-85199)";
    flow:established,to_server;
    content:"POST"; http_method;
    content:"api"; http_uri;
    pcre:"/(?:\.\.(?:/|\\|%2[fF])){2,}/Ui";
    classtype:attempted-admin;
    sid:202685199;
    rev:1;
    metadata:attack_target_server, created_at_2026_06_15, deployment_impact, cve CVE-2026-85199;
    reference:cve,2026-85199;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85199;
)

Alternatively, matching the HTTP body containing traversal on top-level URI parameters:

alert http any any -> any any (
    msg:"ET EXPLOIT Eclipse aerIOS Self-orchestrator Path Traversal Trigger Via URL-Encoded Identifier (CVE-2026-85199)";
    flow:established,to_server;
    content:"%2e%2e%2f"; http_uri;
    classtype:attempted-admin;
    sid:202685200;
    rev:1;
    metadata:attack_target_server, cve CVE-2026-85199;
)

Elastic Detection

/* EQL to detect URI traversal in Self-orchestrator API logs */
sequence by host.name, source.ip
  [ network where process.name == "docker-proxy" or
      (network.protocol == "http" and
       network.direction == "ingress")
  ] with maxspan = 1m
/* Log-level detection: */
any where process.name == "nginx" or event.module == "nginx" or
    (event.module == "apache" and event.dataset == "apache.access")
    and (
        url.path rlike ".*\\.\\..*" or
        url.path rlike ".*%2e%2e.*" or
        url.path rlike ".*%252e%252e.*"
    )
    and (
        http.request.method in ("POST", "PUT", "DELETE")
    )
// Alternative: correlate with file-system telemetry
file where event.action in ("delete", "write", "change")
    and file.extension == "json"
    and file.path rlike ".*(self.orchestrator|orchestrator).*"
    and not process.name in ("self-orchestrator", "java", "node")

Splunk SPL Query

index=web OR index=proxy OR sourcetype="access_combined"
| where method IN ("POST","PUT","DELETE") 
    AND (uri_path LIKE "%..%2f%" OR uri_path LIKE "%..%252f%" 
         OR uri_path LIKE "%2e%2e%2f%" OR uri_path LIKE "%..\\%")
    AND (uri_path LIKE "%api%" OR uri_path LIKE "%self-orchestrator%")
| eval request_signature = uri_path
| stats count by clientip, method, uri_path, status
| where count > 1
| sort - count
| table _time, clientip, method, uri_path, status, count
| rename clientip as "Source IP", uri_path as "Request URI"

Also, detect the file-system-side effect via audit daemon (Linux):

index=linux_audit sourcetype=linux_audit
    AND (type=DELETED_OBJECT OR type=WRITE)
    AND object_type=file AND object_extension=json
    AND object_path NOT LIKE "/application/safe_dir/*"
| eval suspicious = if(match(object_path, "self-orchestrator|orchestrator"), "yes", "no")
| where suspicious=="yes"
| stats values(object_path) as modified_files by host, auid

Wazuh OSSEC Rule

<rule id="100851" level="12">
    <if_sid>31100</if_sid> <!-- generic web server rule group -->
    <regex>\.\.(/|\\)</regex>
    <regex>\.\.%2[fF]|%2e%2e%2f|%252e%252e</regex>
    <regex>(POST|PUT|DELETE) .*(api|self-orchestrator)</regex>  
    <description>Potential Path Traversal exploitation attempt in Eclipse aerIOS Self-orchestrator API (CVE-2026-85199)</description>
    <group>web_application_attack,cve_2026_85199,path_traversal,</group>
    <mitre>
      <id>T1190</id>
      <id>T1083</id>
    </mitre>
</rule>

<rule id="100852" level="14">
    <if_sid>100851</if_sid>
    <field name="url">\.\.</field>
    <description>Confirmed traversal sequence detected – possible active exploitation of CVE-2026-85199</description>
    <group>high_alert,attack_exploitation,</group>
</rule>

<rule id="100853" level="10">
    <if_sid>550</if_sid>  <!-- audit rule group -->
    <regex>type=DELETED_OBJECT.*\.json</regex>
    <regex>type=WRITE.*\.json</regex>
    <description>Abnormal JSON file deletion/write outside expected aeriOS data dirs</description>
    <group>file_integrity,cve_2026_85199,</group>
</rule>

Mitigation & Patch Guidance

1) Immediate Mitigations (while UNPATCHED)

Because patch confidence is 0/4 and no vendor advisory artifacts are available, treat all instances < 1.2.1 as actively exploitable:

• Network-level isolation: Restrict access to the Self-orchestrator API to trusted management networks only via firewall or security-group rules. Do not expose the API to the internet or untrusted internal zones.
• Enable authentication at a reverse-proxy layer: Place an authenticating proxy (nginx with auth_request, OAuth2-proxy, or cloud IAP) in front of the API. This neutralizes the unauthenticated component of the exploit chain.
• Run the container with least privilege: In the affected deployment config, the container runs elevated. Immediately redeploy with:
  • readOnlyRootFilesystem: true on the container's root FS
  • Drop ALL capabilities via securityContext (capabilities: {drop: ["ALL"]})
  • runAsNonRoot: true with a non-zero UID
  • A dedicated, non-host-mounted volume for the data directory
  • allowPrivilegeEscalation: false
• Set file-system ACLs: Ensure the data directory and its parent paths are writable only by the application service account UID — never as root.
• Network intrusion detection: Deploy temporary IDS signatures from the Detection section above to alert on suspicious traversal activity.

2) Patch / Upgrade Steps

• Upgrade to v1.2.1 or later once validated. Per the NVD description, v1.2.1 introduces identifier validation and sanitization preventing separator characters from escaping intended directories.
• Patch confidence is low (0/4) — the vendor fix is described in the NVD record but has no public diff, advisory URL, or changelog entry in tracked sources. Before deploying, contact Eclipse aeriOS release channels to obtain official advisory and verify artifact integrity/checksums.
• Test the upgrade in staging: verify normal CRUD operations on self-orchestrator resources still function and that identifiers containing legitimate special characters (e.g., hyphens, underscores) are preserved while traversal sequences are blocked.

3) Long-Term Hardening

• Adopt an admission/continuous-scanning workflow: Implement periodic container image scanning and runtime configuration audits to catch privileged container deployments and vulnerable orchestrator versions.
• Shift-left: Integrate dependency/version checks for org.eclipse.aeriOS artifacts into CI/CD pipelines — fail builds if version < 1.2.1.
• Security review of API parameter handling: Enforce a static application security testing (SAST) gate to catch similar CWE-22 patterns in custom code paths.
• Monitor orchestration telemetry: Maintain baselines of expected JSON CRUD operations by count, path, and UID — alert on deviations (as reflected in Wazuh/Elastic rules).
• Threat model the orchestrator as a trust boundary: Self-orchestrator manages containers; a compromised instance undermines the entire workload stack — treat it as high-value and place under privileged-access-management (PAM) controls.
• Track active exploitation signals: Subscribe to Eclipse security-announce list — CISA KEV currently does NOT list this CVE, and no exploit code has surfaced publicly; re-assess weekly.

References

1. NVD Entry — CVE-2026-85199: https://nvd.nist.gov/vuln/detail/CVE-2026-85199
2. MITRE CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
3. MITRE ATT&CK Technique T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
4. Eclipse aerIOS Project Page (release notes for v1.2.1 to be located): https://projects.eclipse.org/projects/technology.aeriOS
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85199 NOT currently listed; monitor for updates): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Known Threat Actor Campaigns: None reported at time of writing. No exploit-in-the-wild evidence or PoC publication has been identified in tracked sources. The absence of authentication combined with privileged container deployments makes this CVE a high-attention target for opportunistic botnet-style scanning campaigns once public PoCs emerge.