CVE-2026-121819 · Package
NO FIX YET · SEE WHAT TO DO
armeria-xds 1.40.0 through 1.42.0 checks file paths without resolving symbolic links, so a compromised or semi-trusted xDS control plane can make the client read files outside its allowed root directories. In deployments that use a credential injector, text secrets may be sent to an upstream an attacker can observe.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only services that use armeria-xds in the affected range and load configuration from an xDS control plane with DataSourcePolicy. The risk depends on the control plane being compromised or semi-trusted and on symbolic links existing inside allowed directories. Services not using the xDS client or not on the affected versions can skip it. The credential injector case adds secret exposure risk for deployments that use one.
Not affected if default-config, unaffected-version
Who cares armeria, grpc, java, xds
build.gradle or pom.xml) against the affected range 1.40.0 through 1.42.0.A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.