CVE-2026-121819

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream.

Vendor	ly corporation
Product	armeria
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for ly corporation armeria

Be the first to know when new unknown vulnerabilities affecting ly corporation armeria are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

LY Corporation / Armeria

1.40 < 1.43.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

line.github.io: https://line.github.io/security-advisory-blog/CVE-2026-121819/ github.com: https://github.com/line/armeria/security/advisories/GHSA-m64h-m6r5-6jrx