medium · CVSS v3 6.5 · CVSS v4 5.9

CVE-2026-121819

Armeria xDS 1.40.0‑1.42.0 allows a compromised control plane to read files outside allowed directories via unresolved symbolic links. This c

Overview

Armeria xDS 1.40.0‑1.42.0 allows a compromised control plane to read files outside allowed directories via unresolved symbolic links. This can expose header‑compatible text secrets in credential‑injector deployments. The flaw affects the DataSourcePolicy filename containment check.

Description

A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream.

Impact

Confidentiality is at risk as secrets may be leaked to upstream services. Integrity of configuration files can be compromised if an attacker reads or modifies unexpected files. Availability may be impacted if the client misbehaves due to unexpected file access. Defenders of Armeria‑based services should treat this as a potential data exposure vector.

Remediation

Upgrade to Armeria xDS 1.43.0 or later where symlink resolution is enforced. If upgrading is not possible, remove or relocate any symbolic links inside allowed directories, or configure the client to reject symlinks. Additionally, disable credential‑injector or ensure secrets are not exposed upstream, and monitor logs for anomalous file access.

Risk context

The vulnerability has a medium severity (CVSS 6.5) and no EPSS data. It represents a moderate risk that should be addressed promptly, but it is not an immediate critical threat.

Affected products

  • Armeria xDS 1.40.0-1.42.0

Scores

Severity
medium
CVSS v2
5
CVSS v3
6.5
CVSS v4
5.9
EPSS
—

armeria xds symlink confidentiality credential-injector medium patch

← All CVEs

Related CVEs

medium

CVE-2026-114427

The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.

View analysis

medium

CVE-2026-120659

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.

View analysis

medium

CVE-2026-123287

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

View analysis

medium

CVE-2026-84164

The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML. The input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one.

View analysis