CVE-2026-121819

Name of the Vulnerable Software and Affected Versions armeria-xds versions 1.40.0 through 1.42.0

Description The DataSourcePolicy fails to resolve symbolic links when checking filename containment. This allows a compromised or semi-trusted xDS control plane to force the xDS client to read files located outside the configured allowed root directories if a symbolic link within an allowed directory points to an external location. In environments utilizing a credential injector, this could lead to the exposure of header-compatible text secrets to an attacker-observable upstream.

Recommendations Update armeria-xds to a version newer than 1.42.0.