PT-2025-45117 · Gateway · Gateway

Published 2025-11-04 · Updated 2025-11-17 · CVE-2025-64323

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions kgateway versions 2.0.4 and below kgateway versions 2.1.0-agw-cel-rbac through 2.1.0-rc.2

Description kgateway, a Cloud-Native API and AI Gateway, is affected by a lack of authentication. This allows any client with network access to the xDS port to retrieve sensitive configuration data. The exposed data includes certificate data, backend service information, routing rules, and cluster metadata.

Recommendations Update to version 2.0.5 or later. Update to version 2.1.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-64323

GHSA-4766-X535-JW3R

GO-2025-4094

Affected Products

Gateway

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64323.json · Exploit
• https://osv.dev/vulnerability/GHSA-4766-x535-jw3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64323 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64323 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4094 · Vendor Advisory
• https://github.com/kgateway-dev/kgateway/pull/12471 · Note
• https://github.com/kgateway-dev/kgateway/pull/12535 · Note
• https://github.com/kgateway-dev/kgateway/issues/10651 · Note
• https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r · Note
• https://github.com/kgateway-dev/kgateway · Note
• https://t.me/cveNotify/142058 · Telegram Post
• https://t.me/CVEtracker/36739 · Telegram Post
• https://twitter.com/CVEnew/status/1986651574702350510 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1986664834293744090 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1op46de/resumen_diario_de_vulnerabilidades_05112025 · Reddit Post