CVE-2026-121819 A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment withou
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121819?
CVE-2026-121819 is a medium-severity vulnerability in LY Corporation Armeria, published on 6 Nov 2026.
Official description
A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream.
Weakness: CWE-59
Which versions are affected by CVE-2026-121819?
How do I fix CVE-2026-121819?
No fix has been published for CVE-2026-121819 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121819 being exploited?
There is no known exploitation of CVE-2026-121819 in the wild and no public exploit code.
Sources
Also known as GHSA-m64h-m6r5-6jrx.