{"items":[{"id":"NVI-00016235","kind":"vulnerability","title":"Armeria: External Control of File Name or Path in xDS SDS DataSource","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hgw6-8c77-v4gq","CVE-2026-11752"],"plain_summary":"GitHub lists this reviewed advisory for com.linecorp.armeria:armeria-xds. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-50f97157106cbcfa7db47dd83134d2f9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-50f97157106cbcfa7db47dd83134d2f9","url":"https://github.com/advisories/GHSA-hgw6-8c77-v4gq","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-hgw6-8c77-v4gq","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:43.724Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-50f97157106cbcfa7db47dd83134d2f9"],"technology":"com.linecorp.armeria:armeria-xds","known_exclusions":[],"conditions_summary":"## External Control of File Name or Path in xDS SDS DataSource\n\n### Summary\n\n`DataSourceStream` in the `:xds` module resolves control-plane-supplied `filename` and `environment_variable` fields from SDS Secret resources without any allow-list or base-directory confinement. A semi-trusted or compromised xDS control plane (or an attacker who can MITM SDS responses) can read arbitrary local files and environment variables on the xDS client host.\n\n**Affected component:** `xds/src/main/java/com/linecorp/armeria/xds/DataSourceStream.java`\n**Introduced in:** Armeria 1.38.0 (commit `b199560b10`, \"Add support for SDS\", #6597)\n**Affected versions:** 1.38.0, 1.39.0\n\n### Impact\n\nA semi-trusted or compromised xDS control plane (or an attacker who can inject/MITM SDS responses) can:\n\n- **Read arbitrary files** on the xDS client host — TLS private keys, `/etc/passwd`, mounted Kubernetes service-account tokens, cloud credential files, etc.\n- **Read arbitrary environment variables** — `AWS_SECRET_ACCESS_KEY`, CI tokens, database credentials, etc.\n\nThe read bytes are consumed as TLS key/cert/CA material. Combined with CWE-295 (silent disabling of upstream TLS peer verification), the exfiltrated secr","public_affected_ranges":["< 1.40.0"]}],"null_published_at":"2026-11-04T10:04:27.921Z","source_updated_at":"2026-07-15T21:51:39.000Z","source_disclosed_at":"2026-06-18T17:22:17.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T09:59:43.724Z"}],"next_cursor":null,"snapshot_revision":"42594"}