Executive brief
Armeria is an open-source asynchronous framework used to build microservices. A security flaw in its xDS module allows a compromised or malicious control plane to instruct the Armeria client to read sensitive local files and environment variables. This could lead to the theft of private keys, database credentials, or cloud access tokens, potentially compromising the entire host environment.
Technical details
A vulnerability exists in the armeria-xds module (specifically DataSourceStream.java) where filename and environment_variable fields from SDS (Secret Discovery Service) resources are resolved without allow-list or base-directory confinement. An attacker who controls the xDS control plane or can perform a Man-in-the-Middle (MITM) attack on SDS responses can provide arbitrary paths or variable names. The client will then read these local resources (such as /etc/passwd or AWS keys) and consume them as TLS material. When combined with potential certificate validation issues, this allows for significant information disclosure. The issue affects versions 1.38.0 and 1.39.0; a fix is expected in version 1.40.0.
Affected products
- LY Corporation Armeria 1.38.0 to 1.39.0
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-06-19: disclosed: CVE published to NVD