CVE-2026-11752

CVE-2026-11752 is a medium-severity security vulnerability in com.linecorp.armeria:armeria-xds (maven), affecting versions < 1.40.0. It is fixed in 1.40.0.

Does this CVE actually affect you?

Kodem shows which CVEs are reachable and running in your applications, so you fix what's exploitable, not just what's listed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence, not another scanner.

Summary

Armeria: External Control of File Name or Path in xDS SDS DataSource

External Control of File Name or Path in xDS SDS DataSource

DataSourceStream in the :xds module resolves control-plane-supplied filename and environment_variable fields from SDS Secret resources without any allow-list or base-directory confinement. A semi-trusted or compromised xDS control plane (or an attacker who can MITM SDS responses) can read arbitrary local files and environment variables on the xDS client host.

Affected component: xds/src/main/java/com/linecorp/armeria/xds/DataSourceStream.java
Introduced in: Armeria 1.38.0 (commit b199560b10, "Add support for SDS", #6597)
Affected versions: 1.38.0, 1.39.0

Workarounds

  • Ensure the xDS control plane channel is authenticated and encrypted (mTLS) to prevent MITM injection of malicious SDS responses.
  • Run the xDS client with minimal filesystem permissions and a restricted environment to limit the blast radius of arbitrary reads.
  • If SDS file-based secrets are not needed, consider using inline DataSource bytes only (delivered over the SDS stream itself) and auditing control-plane configurations to ensure no filename or environment_variable DataSources are present.

Impact

A semi-trusted or compromised xDS control plane (or an attacker who can inject/MITM SDS responses) can:

  • Read arbitrary files on the xDS client host, TLS private keys, /etc/passwd, mounted Kubernetes service-account tokens, cloud credential files, etc.
  • Read arbitrary environment variables, AWS_SECRET_ACCESS_KEY, CI tokens, database credentials, etc.

The read bytes are consumed as TLS key/cert/CA material. Combined with CWE-295 (silent disabling of upstream TLS peer verification), the exfiltrated secret can be presented to an attacker-chosen upstream, enabling data exfiltration. This is a confused-deputy / information-disclosure primitive driven entirely by control-plane-supplied configuration.

Severity: High, arbitrary host-level file and environment variable read via control-plane-pushed configuration.

Affected versions

com.linecorp.armeria:armeria-xds (< 1.40.0)

Security releases

com.linecorp.armeria:armeria-xds → 1.40.0 (maven)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

1.40.0

The fix should:

  1. Confine filename resolution to an operator-configured allow-list of base directories. After normalization, reject any path that escapes the allow-listed root.
  2. Gate environment_variable behind an explicit operator allow-list of permitted variable names.
  3. Default to denying both filename and environment_variable DataSources for control-plane-delivered (SDS) secrets unless explicitly enabled by the operator. This is stricter than upstream Envoy but appropriate when the control plane is not fully trusted.
  4. Document the trust model clearly so operators understand that enabling file/env DataSources grants the control plane host-level read capability.

Frequently Asked Questions

  1. What is CVE-2026-11752? CVE-2026-11752 is a medium-severity security vulnerability in com.linecorp.armeria:armeria-xds (maven), affecting versions < 1.40.0. It is fixed in 1.40.0.
  2. Which versions of com.linecorp.armeria:armeria-xds are affected by CVE-2026-11752? com.linecorp.armeria:armeria-xds (maven) versions < 1.40.0 is affected.
  3. Is there a fix for CVE-2026-11752? Yes. CVE-2026-11752 is fixed in 1.40.0. Upgrade to this version or later.
  4. Is CVE-2026-11752 exploitable, and should I be worried? Whether CVE-2026-11752 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  5. What actually determines whether CVE-2026-11752 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  6. How do I fix CVE-2026-11752? Upgrade com.linecorp.armeria:armeria-xds to 1.40.0 or later.

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo