CVE-2026-121819

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121819", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "state": "PUBLISHED", "assignerShortName": "LY-Corporation", "dateReserved": "2026-11-04T05:50:04.721Z", "datePublished": "2026-11-06T07:46:45.370Z", "dateUpdated": "2026-11-10T17:23:02.739Z"}, "containers": {"cna": {"affected": [{"vendor": "LY Corporation", "product": "Armeria", "defaultStatus": "unaffected", "versions": [{"version": "1.40", "status": "affected", "versionType": "custom", "lessThan": "1.43.0"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream."}], "references": [{"url": "https://line.github.io/security-advisory-blog/CVE-2026-121819/"}, {"url": "https://github.com/line/armeria/security/advisories/GHSA-m64h-m6r5-6jrx"}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2026-11-06T07:46:45.370Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-59", "lang": "en", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T17:22:34.642521Z", "id": "CVE-2026-121819", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T17:23:02.739Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-121819", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T17:22:34.642521Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T17:22:47.982Z"}}], "cna": {"metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "LY Corporation", "product": "Armeria", "versions": [{"status": "affected", "version": "1.40", "lessThan": "1.43.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://line.github.io/security-advisory-blog/CVE-2026-121819/"}, {"url": "https://github.com/line/armeria/security/advisories/GHSA-m64h-m6r5-6jrx"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-59"}]}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2026-11-06T07:46:45.370Z"}}}, "cveMetadata": {"cveId": "CVE-2026-121819", "state": "PUBLISHED", "dateUpdated": "2026-11-10T17:23:02.739Z", "dateReserved": "2026-11-04T05:50:04.721Z", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "datePublished": "2026-11-06T07:46:45.370Z", "assignerShortName": "LY-Corporation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Armeria", "vendor": "LY Corporation", "versions": [{"lessThan": "1.43.0", "status": "affected", "version": "1.40", "versionType": "custom"}]}], "source": "dl_cve@linecorp.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream."}], "id": "CVE-2026-121819", "lastModified": "2026-11-10T18:17:20.810", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "dl_cve@linecorp.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121819", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T17:22:34.642521Z", "version": "2.0.3"}}]}, "published": "2026-11-06T08:17:20.237", "references": [{"source": "dl_cve@linecorp.com", "url": "https://github.com/line/armeria/security/advisories/GHSA-m64h-m6r5-6jrx"}, {"source": "dl_cve@linecorp.com", "url": "https://line.github.io/security-advisory-blog/CVE-2026-121819/"}], "sourceIdentifier": "dl_cve@linecorp.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "com.linecorp.armeria/armeria-xds: armeria-xds: Information disclosure via unresolved symbolic links in DataSourcePolicy", "id": "2568047", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568047"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-59", "details": ["A flaw was found in armeria-xds. This vulnerability can lead to information disclosure if a compromised or semi-trusted discovery service (xDS) control plane directs the client to read arbitrary files. Because the path validation mechanism in DataSourcePolicy fails to resolve symbolic links, files outside the permitted root directories can be accessed, potentially exposing sensitive credentials and system data."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-121819", "public_date": "2026-11-06T07:46:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-121819"], "statement": "This vulnerability is rated as Moderate severity because successful exploitation requires significant prerequisites, specifically control over a malicious or compromised discovery service control plane alongside existing symbolic links pointing outside designated root paths. In typical Red Hat environments, applications interact only with trusted control planes, which prevents unauthorized remote manipulation of data source policies. Furthermore, the impact is confined to information disclosure of specific sensitive files rather than arbitrary code execution or integrity loss.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.40,1.43.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Armeria", "source": "cna", "vendor": "LY Corporation"}, "product": "armeria", "vendor": "ly_corporation"}], "created": "2026-11-06T09:30:08.596036+00:00", "updated": "2026-11-06T16:00:08.115994+00:00", "vendors": ["ly_corporation", "ly_corporation$PRODUCT$armeria"]}