Read the docs
TI-2026-85773 Aliases CVE-2026-121819

Armeria xDS reads files outside allowed roots via symbolic links

Priority LOW 26Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Armeria xDS (armeria-xds) versions 1.40.0 through 1.42.0 are affected. DataSourcePolicy checks that filenames stay inside allowed root directories without resolving symbolic links. A compromised or semi-trusted xDS control plane can make the xDS client read files outside those roots via a symbolic link inside an allowed directory. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream.

Why it matters now

EPSS 0.00325 25th percentileScored 2026-11-07
Fix Fixed Armeria (LY Corporation): 1.43.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LY CorporationArmeria1.40 to before 1.43.01.43.0Patch availableCNA
  • Armeria VendorLY Corporation Affected 1.40 to before 1.43.0 Fixed in 1.43.0 Patch available CNA

Remediation

Upgrade Armeria to 1.43.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Armeria (LY Corporation) Fixed in 1.43.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    LY Armeria 1.43.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-85775 Path restrictions ignored by any-origin CORS policy in LY Corporation ArmeriaPriority LOW 24
    • TI-2026-85776 Armeria Stored XSS via File Names in Directory ListingPriority LOW 11
    Show all 3 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-121819
  2. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2026-10143 Hard-coded credentials in LY Corporation Central Dogma CVSS 4.0CRITICAL 9.4
  • TI-2026-10142 A vulnerability has been identified in centraldogma-server-mirror-git versions prior to… CVSS 4.0HIGH 8.8
  • TI-2026-10145 LDAP injection in LY Corporation Central Dogma CVSS 4.0MEDIUM 6.9
  • TI-2026-14054 A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. CVSS 4.0HIGH 8.7
  • TI-2026-10146 A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS… CVSS 4.0CRITICAL 9.1
  • TI-2026-85778 Excessive memory allocation in Armeria from malformed Thrift messages CVSS 4.0HIGH 8.7
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences