PT-2026-50823 · Ly+1 · Armeria+1
Published
2026-06-18
·
Updated
2026-06-19
·
CVE-2026-11752
CVSS v4.0
5.9
Medium
| Vector | AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
armeria-xds versions 1.38.0 through 1.39.0
Description
DataSourceStream in the xDS module resolves filename and environment variable fields from SDS Secret resources without an allow-list or base-directory confinement. This allows a compromised or semi-trusted xDS control plane, or an attacker performing a man-in-the-middle attack on SDS responses, to read arbitrary local files and environment variables on the xDS client host. This information disclosure can be used to exfiltrate sensitive data such as TLS private keys, system files, cloud credentials, and database tokens. The issue is located in the xds/src/main/java/com/linecorp/armeria/xds/DataSourceStream.java component.Recommendations
Update to version 1.40.0.
Ensure the xDS control plane channel is authenticated and encrypted using mTLS to prevent the injection of malicious SDS responses.
Run the xDS client with minimal filesystem permissions and a restricted environment to limit the impact of arbitrary reads.
Use inline
DataSource bytes delivered over the SDS stream instead of file-based secrets and audit control-plane configurations to ensure no filename or environment variable DataSources are present.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Armeria
Com.Linecorp.Armeria:Armeria-Xds