Vulnerability Description
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local files and environment variables on the xDS client host.
References
FAQ
What is CVE-2026-11752?
CVE-2026-11752 is a documented vulnerability. A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables witho...
How severe is CVE-2026-11752?
CVSS scoring is not yet available for CVE-2026-11752. Check NVD for updates.
Is there a patch for CVE-2026-11752?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.