{"id":"CVE-2026-121821","kind":"vulnerability","aliases":["CVE-2026-121821"],"related":[],"title":"Armeria: any-origin CORS policy ignores path restrictions, exposing excluded responses","description":"A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.","summary":"Armeria, a Java microservice framework, applies any-origin CORS policies without enforcing configured path restrictions. A malicious website visited by a logged-in victim can read sensitive responses from excluded paths when credentials are enabled.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["armeria","cors","java","package","web-services"],"not_affected_if":["credentials-disabled","no-cors-policy","versions-outside-range"],"how_to_check":"- Check the Armeria version in the build file (for example Gradle or Maven dependency) against the affected range `0.84.0` to `1.42.0`\n- Look for CORS configuration using an any-origin policy combined with credentials enabled and path restrictions","fix":"- Armeria: the sources do not name a fixed version, so unknown","status":"open","published_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:39+00:00","updated_at":"2026-11-06T08:42:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T08:42:39Z","model":"claude-haiku-5-5","output":{"fix":"- Armeria: the sources do not name a fixed version, so unknown","reach":"internet","title":"Armeria: any-origin CORS policy ignores path restrictions, exposing excluded responses","impact":"medium","summary":"Armeria, a Java microservice framework, applies any-origin CORS policies without enforcing configured path restrictions. A malicious website visited by a logged-in victim can read sensitive responses from excluded paths when credentials are enabled.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","armeria","cors","web-services"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive responses from excluded paths in victim's session","analyst_note":"Confirm the fixed version and the vendor advisory linked from the sources (github.com advisory) since the fix is not stated.","how_to_check":"- Check the Armeria version in the build file (for example Gradle or Maven dependency) against the affected range `0.84.0` to `1.42.0`\n- Look for CORS configuration using an any-origin policy combined with credentials enabled and path restrictions","plain_action":"","needs_analyst":true,"not_affected_if":["no-cors-policy","credentials-disabled","versions-outside-range"],"who_is_affected":"Teams running Armeria services in the affected range that use an any-origin CORS policy with credentials enabled and path-based CORS exclusions. An attacker needs a victim who is logged in and visits an attacker-controlled website. Services not using Armeria CORS, or without credentials, are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":4261,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121821':15A,18A '-2026':14A,17A '0.84.0':71C '1.42.0':73C 'allow':86C 'any-origin':2A,32B,75C 'appli':31B 'armeria':1A,19B,26B,69C 'attack':89C 'attacker-control':88C 'authent':95C,114C 'browser':112C 'configur':39B,83C 'control':90C 'cor':5A,20B,35B,78C 'credenti':60B,105C,115C 'cve':13A,16A 'enabl':62B,107C 'enforc':38B,82C 'exclud':11A,57B,102C 'expos':10A 'framework':30B 'identifi':67C 'ignor':7A 'java':21B,28B 'log':49B 'logged-in':48B 'malici':43B 'microservic':29B 'origin':4A,34B,77C 'packag':22B 'path':8A,40B,58B,84C,103C 'polici':6A,36B,79C 'read':53B,98C 'respons':12A,55B,100C 'restrict':9A,41B,85C 'send':113C 'sensit':54B,99C 'servic':25B 'version':70C 'victim':51B,96C,110C 'visit':45B,92C 'vulner':64C 'web':24B 'web-servic':23B 'websit':44B,91C 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running Armeria services in the affected range that use an any-origin CORS policy with credentials enabled and path-based CORS exclusions. An attacker needs a victim who is logged in and visits an attacker-controlled website. Services not using Armeria CORS, or without credentials, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["armeria","cors","java","medium","package","webservices"],"campaign_type":null,"search_a":"'-121821':15A,18A '-2026':14A,17A 'any-origin':2A 'armeria':1A 'cor':5A 'cve':13A,16A 'exclud':11A 'expos':10A 'ignor':7A 'origin':4A 'path':8A 'polici':6A 'respons':12A 'restrict':9A","search_b":"'any-origin':32B 'appli':31B 'armeria':19B,26B 'configur':39B 'cor':20B,35B 'credenti':60B 'enabl':62B 'enforc':38B 'exclud':57B 'framework':30B 'java':21B,28B 'log':49B 'logged-in':48B 'malici':43B 'microservic':29B 'origin':34B 'packag':22B 'path':40B,58B 'polici':36B 'read':53B 'respons':55B 'restrict':41B 'sensit':54B 'servic':25B 'victim':51B 'visit':45B 'web':24B 'web-servic':23B 'websit':44B 'without':37B","search_c":"'0.84.0':71C '1.42.0':73C 'allow':86C 'any-origin':75C 'armeria':69C 'attack':89C 'attacker-control':88C 'authent':95C,114C 'browser':112C 'configur':83C 'control':90C 'cor':78C 'credenti':105C,115C 'enabl':107C 'enforc':82C 'exclud':102C 'identifi':67C 'origin':77C 'path':84C,103C 'polici':79C 'read':98C 'respons':100C 'restrict':85C 'send':113C 'sensit':99C 'version':70C 'victim':96C,110C 'visit':92C 'vulner':64C 'websit':91C","first_public_at":"2026-11-06T07:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dl_cve@linecorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121821","severity":null,"published_at":"2026-11-06T08:17:20+00:00","modified_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[{"id":84761,"url":"https://github.com/line/armeria/security/advisories/GHSA-386q-mrg6-jfj8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T07:16:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}