CVE-2026-86836

Executive Summary

CVE-2026-86836 is a local privilege-escalation and workload-impersonation vulnerability in Eclipse Ankaios, a lightweight container and workload orchestration runtime for automotive and edge systems. Versions 0.1.0 through 1.0.2 create workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash of the workload's runtime configuration, and reuse any pre-existing path based only on an existence/file-type check — without validating owner or permissions.

Any local, unprivileged user with write access to the shared base directory (by default under $TMPDIR/ankaios, commonly world-writable /tmp) can pre-create that path hierarchy and the two Control Interface FIFOs before the agent starts. The agent then adopts the attacker-owned FIFOs as the legitimate Control Interface for the targeted workload, allowing the attacker to complete the handshake and issue requests under that workload's configured controlInterfaceAccess permissions — impersonating the workload and, depending on permissions, reading or modifying the cluster's desired state. No patch exists as of this report.

Technical Analysis

Eclipse Ankaios runs a control-plane agent that communicates with the orchestrator and coordinates workloads. For each workload, the agent establishes a Control Interface over Unix named pipes (FIFOs). The NVD description states the agent derives the on-disk location of workload files and Control Interface FIFOs from two inputs:

1. The agent name.
2. A hash of the workload's runtime configuration.

This produces a deterministic, predictable path. Because the derivation is deterministic, the path for a given workload is stable across restarts and reproducible by anyone who can observe or guess the agent name and the workload configuration (both are typically visible in configuration files, logs, or from a co-resident process).

The core defect is the validation gap: when the agent starts or restarts, it checks only whether a directory or FIFO already exists at the derived path and verifies its file type. It does not validate the owner (UID/GID) or permissions of the existing object. Per CWE-276 (Incorrect Default Permissions), the security assumption — that any object at the derived path is trusted and agent-created — is never enforced.

The attack exploits the mismatch between the predictable location and the untrusted base directory. The default base is $TMPDIR/ankaios; where $TMPDIR resolves to a shared, world-writable location such as /tmp, an unprivileged local user can write into it. The attacker pre-creates:

• the path hierarchy for the targeted workload, and
• the two Control Interface FIFOs at the derived path.

When the agent (re)starts, its existence/file-type check succeeds, and it treats the attacker-owned FIFOs as the legitimate Control Interface for that workload. There is no cryptographic or ownership check to distinguish attacker-controlled FIFOs from agent-created ones.

Once adoption occurs, the attacker owns both ends effectively: they can complete the Control Interface handshake and submit requests. The agent processes those requests under the targeted workload's configured controlInterfaceAccess permissions rather than under the attacker's identity. This is the impersonation primitive — the attacker borrows the workload's authorization context.

Key technical facts, strictly from the description:

• Affected versions: 0.1.0 through 1.0.2.
• Default base path: under $TMPDIR/ankaios.
• Object types: workload files and two Control Interface FIFOs.
• Path derivation: agent name + hash of workload runtime configuration.
• Flawed check: existence and/or file-type check only, no owner/permission validation.
• Authorization abused: the workload's controlInterfaceAccess permissions.
• Impact surface: reading and/or modification of the cluster's desired state.

No function names, class names, or internal API identifiers are provided in the source data; the analysis is therefore bounded to the vulnerability class (predictable-path + missing ownership validation → local impersonation) and mechanism, without inventing implementation identifiers.

Exploitation Scenarios

Prerequisite: Local, unprivileged access to the host running the Ankaios agent, and write access to the base directory (default $TMPDIR/ankaios, e.g. shared /tmp). No network exposure is required, which matches a local attack vector.

Step 1 — Reconnaissance / target identification. The attacker determines (a) the agent name and (b) the targeted workload's runtime configuration sufficient to compute the config hash used in path derivation. In automotive/edge deployments these are frequently discoverable through readable config files, process listings, or logs on the same host. Because the path derivation is deterministic, the attacker can compute the expected path hierarchy offline.

Step 2 — Triggering the flaw class (predictable-path pre-creation). The attacker pre-creates, under $TMPDIR/ankaios, the derived path hierarchy for the targeted workload and, critically, the two Control Interface FIFOs at that path, before the agent starts or restarts. This is a classic TOCTOU-style precedence attack: the attacker occupies the predictable namespace first.

Step 3 — Adoption and handshake. On (re)start, the agent performs only an existence/file-type check on the pre-existing objects. It does not validate owner or permissions, so it accepts the attacker-owned FIFOs as the legitimate Control Interface. The attacker, holding the other end of those FIFOs, completes the Control Interface handshake and begins issuing requests. No public PoC is available; the handshake and request flow are inferred from the documented Control Interface mechanism and the vulnerability class.

Step 4 — Impersonation and impact. Requests are processed under the targeted workload's configured controlInterfaceAccess permissions. The attacker thereby impersonates the workload and, depending on those permissions, can read and/or modify the cluster's desired state. Where a workload holds broad permissions, this can cascade into broader cluster manipulation.

Reliability notes: The attack depends on winning the race against agent startup and on write access to the shared base directory. Restart windows and reboot events are favorable timing conditions. On hosts where $TMPDIR is a private, non-world-writable directory, the prerequisite local write access is not met and the attack is not viable in that configuration.

Impact Assessment

• Confidentiality (High): Unauthorized reading of the cluster's desired state and any workload data reachable through the impersonated workload's permissions.
• Integrity (High): Unauthorized modification of the desired state, enabling manipulation of orchestration outcomes within the abused workload's authorization scope.
• Availability: Not directly rated; denial-of-service is not described, though state modification could indirectly cause disruption.
• Privileges Required (Low): Only an unprivileged local account with write access to the shared base directory is needed.
• Attack Vector (Local): No remote exposure required.
• User Interaction (None): The agent performs the vulnerable action autonomously at startup/restart.

Blast radius: Any multi-user or multi-tenant host where $TMPDIR resolves to a shared, world-writable location (e.g., /tmp) and multiple accounts coexist. In automotive/edge fleets, co-resident processes or less-trusted local users increase exposure. Because impersonation inherits controlInterfaceAccess permissions, blast radius scales with how permissive the targeted workload's grants are — a broadly privileged workload yields proportionally larger impact on the cluster's desired state. EPSS is 0.00086 (0.4th percentile) and CISA KEV status is NO, indicating no observed exploitation pressure to date; the primary risk is from local insiders or co-resident untrusted code rather than opportunistic mass exploitation.

The CVSS vector above is a derived severity assessment for this defect class under CVSS:3.1; the official CVSS score and vector are not published (N/A) and must be treated as unavailable.

Detection Guidance

Detection centers on unauthorized creation of the $TMPDIR/ankaios path hierarchy and FIFOs by non-agent users, unusual ownership of the agent's Control Interface objects, and abnormal write activity on the agent's FIFO namespace prior to agent startup. File-integrity and auditd/Fanotify events on /tmp/ankaios and equivalent $TMPDIR locations are the highest-signal data sources.

Sigma Rule

title: Eclipse Ankaios Control Interface FIFO Pre-Creation by Unprivileged User
id: 7b1c6e42-9a3d-4f21-b8ce-2d5f0a9c1e77
status: experimental
description: Detects pre-creation or modification of Ankaios worker FIFOs / path hierarchy
  under the agent base directory by a non-agent user, indicating CVE-2026-86836 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86836
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_path:
    type: 'PATH'
    name|startswith:
      - '/tmp/ankaios'
      - '/tmp/ankaios/'
  selection_syscall:
    syscall|contains:
      - 'mkfifo'
      - 'mknod'
      - 'open'
      - 'openat'
  selection_fifo_type:
    name|endswith:
      - '.fifo'
      - '.ctl'
      - '.control'
  filter_agent:
    exe|endswith:
      - '/ankaios'
      - '/ank-agent'
  condition: selection_path and (selection_syscall or selection_fifo_type) and not filter_agent
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.86836

YARA Rule

rule CVE_2026_86836_Ankaios_FIFO_Precreation
{
    meta:
        author      = "Valters IT Threat Intelligence"
        description = "Detects artifacts referencing Ankaios Control Interface FIFO paths consistent with CVE-2026-86836 pre-creation"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-86836"
        cve         = "CVE-2026-86836"
        date        = "2026-01-01"

    strings:
        $ankaios_dir = "/ankaios" ascii wide nocase
        $tmpdir      = "TMPDIR" ascii wide
        $fifo        = "fifo" ascii wide nocase
        $ci          = "Control Interface" ascii wide nocase
        $mkfifo      = "mkfifo" ascii wide

    condition:
        filesize < 1MB and
        $ankaios_dir and
        ( $tmpdir or $fifo or $ci or $mkfifo )
}

Suricata IDS Rule

alert filesize any any -> any any (msg:"CVE-2026-86836 Eclipse Ankaios Control Interface FIFO path artifact observed"; flow:to_server; file.name; content:"ankaios"; nocase; file.name; content:"fifo"; nocase; metadata:cve CVE-2026-86836, attack_target Host, confidence Low; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-86836; classtype:attempted-user; sid:202686836; rev:1;)

Note: CVE-2026-86836 is a local, filesystem-level vulnerability with no network traffic in the exploitation path. The Suricata rule above is a best-effort file-artifact detector and will not reliably detect exploitation; endpoint file-integrity monitoring (see Wazuh and Sigma rules) is the authoritative detection layer.

Elastic Detection

file where event.category == "file" and
  event.action in ("creation", "modification")
  and file.path : "/tmp/ankaios*"
  and process.name != null
  and not process.name in ("ankaios", "ank-agent", "ank")

Splunk SPL Query

index=os OR index=audit sourcetype=auditd OR sourcetype=sysmon_linux
| search (path="/tmp/ankaios*" OR name="/tmp/ankaios*" OR file_path="/tmp/ankaios*")
| search (syscall=mkfifo OR syscall=mknod OR action=created OR action=modified OR type=PATH)
| eval is_agent=if(match(lower(process) OR lower(exe), "ankaios|ank-agent|ank$"), 1, 0)
| where is_agent=0
| stats count min(_time) as first_seen max(_time) as last_seen values(process) as processes values(user) as users by host, path
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="ankaios,cve-2026-86836,">
  <rule id="100686" level="12">
    <if_sid>550</if_sid>
    <field name="file">/tmp/ankaios</field>
    <description>CVE-2026-86836: Possible Ankaios Control Interface FIFO/path pre-creation by unprivileged user</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,pci_dss_10.2.7,</group>
  </rule>

  <rule id="100687" level="12">
    <if_sid>554</if_sid>
    <field name="file">/tmp/ankaios</field>
    <match>fifo|mkfifo|mknod</match>
    <description>CVE-2026-86836: Ankaios FIFO namespace modification detected under TMPDIR/ankaios</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch, vendor fix, or fixed version identified in any tracked source; OSV package status is unfixed). Treat the following as compensating controls, not remediations. No official vendor workaround has been published.

1) Immediate mitigations (compensating controls):

• Remove the shared-directory precondition. Configure $TMPDIR (or the equivalent base directory) to a private, per-service directory that is not world-writable — for example, a directory owned by the agent's runtime user with mode 0700. This breaks the attacker's ability to pre-create the path hierarchy. This is the single most effective mitigation.
• Harden the base directory. Ensure the Ankaios base path is owned exclusively by the agent's service account with restrictive permissions, and mounted on a namespace not writable by other local users (e.g., a private mount namespace or PrivateTmp).
• Isolate the agent. Run the Ankaios agent under a dedicated unprivileged account/namespace with its own private TMPDIR, minimizing co-resident users on the host.
• Monitor and alarm on creation/modification of objects under $TMPDIR/ankaios by any user other than the agent, and on ownership mismatches of the Control Interface FIFOs (see Detection Guidance).
• Restrict controlInterfaceAccess permissions to the minimum required so that any successful impersonation yields limited desired-state impact (defense in depth).

2) Patch / upgrade steps:

• No fixed version is available. Track the Eclipse Ankaios project advisories and release notes for a version that adds owner/permission validation before FIFO reuse. When a fix is released, upgrade affected agents (0.1.0 through 1.0.2) immediately.
• After upgrade, verify that the agent validates ownership and permissions of any pre-existing path and FIFO before reuse, and that it refuses objects not owned by the agent's user.

3) Long-term hardening:

• Require agents to use cryptographically robust, non-world-writable runtime directories by default; never derive security-sensitive paths under world-writable locations such as shared /tmp.
• Enforce ownership and permission checks (not merely existence/file-type) on all reused security-relevant filesystem objects.
• Adopt namespace isolation (PrivateTmp-style) for orchestration agents as a standard deployment baseline.
• Add file-integrity monitoring and auditd rules for the agent's FIFO namespace as permanent detections.
• Integrate CVE-2026-86836 into local privilege-escalation threat models for multi-tenant and edge/automotive hosts.

References

• NVD — CVE-2026-86836: https://nvd.nist.gov/vuln/detail/CVE-2026-86836
• Eclipse Ankaios project (vendor): https://github.com/eclipse-ankaios/ankaios
• Eclipse Foundation Security Advisories: https://www.eclipse.org/security/
• CWE-276 — Incorrect Default Permissions: https://cwe.mitre.org/data/definitions/276.html
• OSV — Eclipse Ankaios advisory database entry (package status: unfixed): https://osv.dev/

Threat actor / exploit-in-the-wild evidence: None. EPSS is 0.00086 (0.4th percentile), CISA KEV status is NO, and no public PoC, exploit code, or Nuclei template has been identified. No threat actor campaigns are attributed to this CVE at the time of writing. The vulnerability is currently unattractive for mass exploitation and is most relevant to local privilege-escalation and insider-threat scenarios on hosts using shared, world-writable temporary directories.