kgateway is missing xDS authorization
Priority LOW 23CWE-862Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Fix Fixed kgateway (kgateway-dev): 2.1.0, 2.0.5github.com/kgateway-dev/kgateway/v2 (Go): 2.1.0, 2.0.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kgateway-dev | kgateway | 2.1.0-agw-cel-rbac to before 2.1.0; before 2.0.5 | 2.1.0, 2.0.5 | Patch available | CNA |
| — | github.com/kgateway-dev/kgateway/v2 (Go) | 2.1.0-agw-cel-rbac to before 2.1.0 | 2.1.0 | Patch available | GHSA-4766-x535-jw3r |
| — | github.com/kgateway-dev/kgateway/v2 (Go) | before 2.0.5 | 2.0.5 | Patch available | GHSA-4766-x535-jw3r |
- kgateway Vendorkgateway-dev Affected 2.1.0-agw-cel-rbac to before 2.1.0; before 2.0.5 Fixed in 2.1.0, 2.0.5 Patch available CNA
- github.com/kgateway-dev/kgateway/v2 (Go) Vendor— Affected 2.1.0-agw-cel-rbac to before 2.1.0 Fixed in 2.1.0 Patch available GHSA-4766-x535-jw3r
- github.com/kgateway-dev/kgateway/v2 (Go) Vendor— Affected before 2.0.5 Fixed in 2.0.5 Patch available GHSA-4766-x535-jw3r
Remediation
- Fix · CNA kgateway (kgateway-dev) Fixed in 2.1.0, 2.0.5
- Fix · GHSA-4766-x535-jw3r github.com/kgateway-dev/kgateway/v2 (Go) Fixed in 2.1.0 Advisory →
- Fix · GHSA-4766-x535-jw3r github.com/kgateway-dev/kgateway/v2 (Go) Fixed in 2.0.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64323
- 2026-10-03 Alias added: GHSA-4766-x535-jw3r
References
Sources
- CVE-2025-64323 · CVE Program
- CVE-2025-64323 · NVD
- FIRST EPSS
- GHSA-4766-x535-jw3r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences