https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:34:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-328901 EUVD-2026-328901 https://cve.radiocsirt.org/vuln/euvd-2026-328901 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11752 <p>A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local files and environment variables on the xDS client host.</p> <p>A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local files and environment variables on the xDS client host.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11752 https://cve.radiocsirt.org/vuln/ghsa-hgw6-8c77-v4gq <p><strong>Affected:</strong> Maven: com.linecorp.armeria:armeria-xds</p> <p>## External Control of File Name or Path in xDS SDS DataSource</p> <p>### Summary</p> <p>`DataSourceStream` in the `:xds` module resolves control-plane-supplied `filename` and `environment_variable` fields from SDS Secret resources without any allow-list or base-directory confinement. A semi-trusted or compromised xDS control plane (or an attacker who can MITM SDS responses) can read arbitrary local files and environment variables on the xDS client host.</p> <p>**Affected component:** `xds/src/main/java/com/linecorp/armeria/xds/DataSourceStream.java` **Introduced in:** Armeria 1.38.0 (commit `b199560b10`, &#34;Add support for SDS&#34;, #6597) **Affected versions:** 1.38.0, 1.39.0</p> <p>### Impact</p> <p>A semi-trusted or compromised xDS control plane (or an attacker who can inject/MITM SDS responses) can:</p> <p>- **Read arbitrary files** on the xDS client host — TLS private keys, `/etc/passwd`, mounted Kubernetes service-account tokens, cloud credential files, etc. - **Read arbitrary environment variables** — `AWS_SECRET_ACCESS_KEY`, CI tokens, database credentials, etc.</p> <p>The read bytes are consumed as TLS key/cert/CA material. Combined with CWE-295 (silent disabling of upstream TLS peer verification), the exfiltrated secret can be presented to an attacker-chosen upstream, enabling data exfiltration. This is a confused-deputy / information-disclosure primitive driven entirely by control-plane-supplied configuration.</p> <p>**Severity:** High — arbitrary host-level file and environment variable read via control-plane-pushe…</p> <p><strong>Affected:</strong> Maven: com.linecorp.armeria:armeria-xds</p> <p>## External Control of File Name or Path in xDS SDS DataSource</p> <p>### Summary</p> <p>`DataSourceStream` in the `:xds` module resolves control-plane-supplied `filename` and `environment_variable` fields from SDS Secret resources without any allow-list or base-directory confinement. A semi-trusted or compromised xDS control plane (or an attacker who can MITM SDS responses) can read arbitrary local files and environment variables on the xDS client host.</p> <p>**Affected component:** `xds/src/main/java/com/linecorp/armeria/xds/DataSourceStream.java` **Introduced in:** Armeria 1.38.0 (commit `b199560b10`, &#34;Add support for SDS&#34;, #6597) **Affected versions:** 1.38.0, 1.39.0</p> <p>### Impact</p> <p>A semi-trusted or compromised xDS control plane (or an attacker who can inject/MITM SDS responses) can:</p> <p>- **Read arbitrary files** on the xDS client host — TLS private keys, `/etc/passwd`, mounted Kubernetes service-account tokens, cloud credential files, etc. - **Read arbitrary environment variables** — `AWS_SECRET_ACCESS_KEY`, CI tokens, database credentials, etc.</p> <p>The read bytes are consumed as TLS key/cert/CA material. Combined with CWE-295 (silent disabling of upstream TLS peer verification), the exfiltrated secret can be presented to an attacker-chosen upstream, enabling data exfiltration. This is a confused-deputy / information-disclosure primitive driven entirely by control-plane-supplied configuration.</p> <p>**Severity:** High — arbitrary host-level file and environment variable read via control-plane-pushe…</p> https://cve.radiocsirt.org/vuln/ghsa-hgw6-8c77-v4gq