CVE-2026-121819
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
57/100
Published: 2026-11-06
Modified: 2026-11-10
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
S:
X
AT:
Present
VC:
High
VI:
None
VA:
None
Description
A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| LY Corporation | Armeria | 1.40 < 1.43.0 |
| LY Corporation | Armeria | 1.40 < 1.43.0 |