CVE-2026-121821 · Package
NO FIX YET · SEE WHAT TO DO
Armeria, a Java microservice framework, applies any-origin CORS policies without enforcing configured path restrictions. A malicious website visited by a logged-in victim can read sensitive responses from excluded paths when credentials are enabled.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Armeria services in the affected range that use an any-origin CORS policy with credentials enabled and path-based CORS exclusions. An attacker needs a victim who is logged in and visits an attacker-controlled website. Services not using Armeria CORS, or without credentials, are less exposed.
Not affected if credentials-disabled, no-cors-policy, versions-outside-range
Who cares armeria, cors, java, web-services
0.84.0 to 1.42.0A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.