Armeria-xds Vulnerability in DataSourcePolicy for Line Software
CVE-2026-121819

5.9MEDIUM

Key Information:

Vendor

Ly Corporation

Status
Armeria
Vendor
CVE Published:
6 November 2026

What is CVE-2026-121819?

A vulnerability has been identified in Armeria-xds versions 1.40.0 to 1.42.0, where the DataSourcePolicy inadequately checks filename containment without resolving symbolic links. This flaw permits a compromised xDS control plane to manipulate the xDS client into accessing files outside the designated allowed root directories. Particularly concerning are deployments utilizing a credential injector, as sensitive header-compatible text secrets may inadvertently become exposed to potential attackers.

Affected Version(s)

Armeria 1.40 < 1.43.0

References

https://line.github.io/security-advisory-blog/CVE-2026-12...
https://github.com/line/armeria/security/advisories/GHSA-...

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.