CVE-2026-11752 — LY Corporation / Armeria

CVE-2026-11752

LY Corporation / Armeria PUBLISHED

Description (CNA)

A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local files and environment variables on the xDS client host.

Affected (CNA)

Vendor / product	Versions
LY Corporation / Armeria	affected 1.38.0 before 1.40.0

CWE

No CWE identifiers supplied.

References

https://github.com/line/armeria/security/advisories/GHSA-hgw6-8c77-v4gq

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.