CVE-2026-15704: Critical Auth Bypass in Eclipse BaSyx Go Components

Executive Summary

A critical authorization bypass vulnerability (CVE-2026-15704) has been disclosed in Eclipse BaSyx Go Components, a suite of server components for Industry 4.0 and Industrial IoT deployments. The flaw carries a CVSS score of 9.8 and affects all versions up to and including 1.0.0.

The vulnerability stems from inconsistent trailing-slash handling between the ABAC (Attribute-Based Access Control) middleware and the underlying Chi HTTP router. An attacker can exploit this discrepancy to bypass access controls entirely, reaching endpoints that should be protected by ABAC policy enforcement.

CVSS Score: 9.8 (Critical)

Vulnerability Overview

Root Cause Analysis

Eclipse BaSyx Go Components uses Chi's middleware.StripSlashes middleware in a shared router configuration. The ABAC authorization middleware evaluates access control policy against the original request path, while the HTTP router strips trailing slashes before dispatching to the handler.

This creates a desynchronization between what the ABAC layer sees and what the router ultimately routes:

Request: GET /api/v1/shells/ (trailing slash)
         ↓
ABAC Middleware: evaluates /api/v1/shells/
  → ABAC policy: no rule matches this exact path → PERMIT (fail-open)
         ↓
StripSlashes: path becomes /api/v1/shells
  → Router dispatches to protected handler

When no ABAC rule explicitly covers the slash-appended variant and the policy defaults to permit on no-match, any request with a trailing slash bypasses the intended access control.

Affected Versions

Attack Vector

1. Attacker identifies Eclipse BaSyx Go endpoint protected by ABAC policy
2. Attacker appends trailing slash to the request path (e.g. /api/resource/)
3. ABAC middleware evaluates the slash-suffixed path — no matching deny rule
4. Chi's StripSlashes removes the trailing slash internally
5. Router dispatches to the protected handler as if authorized
6. Attacker achieves unauthenticated access to protected AAS data or operations

Impact

Eclipse BaSyx is widely deployed in Industry 4.0, Smart Factory, and IIoT environments implementing the Asset Administration Shell (AAS) specification. A successful exploit may allow an unauthenticated attacker to:

Remediation

Immediate Actions

1. Upgrade BaSyx Go Components

Apply the patch as soon as an updated release is available from the Eclipse BaSyx project:

# Check current version
go list -m github.com/eclipse-basyx/basyx-go-components
 
# Update to patched version when available
go get github.com/eclipse-basyx/basyx-go-components@latest
go mod tidy

Workarounds (Until Patch is Available)

Option A: Normalize paths before ABAC evaluation

Add explicit path normalization in the middleware chain before the ABAC policy check:

// Normalize trailing slashes before ABAC middleware
router.Use(func(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        r.URL.Path = strings.TrimRight(r.URL.Path, "/")
        next.ServeHTTP(w, r)
    })
})
router.Use(abacMiddleware)
router.Use(middleware.StripSlashes)

Option B: Set ABAC default to deny-all

Configure the ABAC policy to deny by default (fail-closed) rather than permitting on no-match:

# basyx-abac-config.yaml
default_policy: deny  # Change from allow to deny
rules:
  - path: /api/v1/shells
    methods: [GET]
    roles: [reader]
  # ... explicit allow rules

Option C: WAF / Reverse Proxy Path Normalization

Enforce trailing-slash removal at the network boundary before requests reach BaSyx:

# Nginx — remove trailing slashes before proxying to BaSyx
location ~ ^(.+)/$ {
    return 301 $1;
}

Detection

Monitor HTTP access logs for unusual trailing-slash patterns on AAS API paths:

# Example grep pattern for exploitation attempts
grep -E 'GET /api/v1/(shells|submodels|aas)[^"]*/$' /var/log/basyx/access.log

Post-Remediation Checklist

1. Apply patch or implement workaround immediately
2. Audit ABAC policies — ensure deny-default is enforced
3. Review access logs for trailing-slash requests to protected paths
4. Verify path normalization order in middleware chain after any upgrade
5. Network-segment BaSyx components — restrict to internal OT/ICS networks only
6. Enable authentication in front of all BaSyx endpoints exposed beyond localhost

References

• NVD — CVE-2026-15704
• Eclipse BaSyx Project

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• Researcher Publishes GitLab RCE PoC — Authenticated Users Execute Commands as Git