Is CVE-2026-121819 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121819 being exploited in the wild.

How severe is CVE-2026-121819?

Informational severity, published 6 November 2026.

Which products and versions are affected?

LINE Armeria-Xds 1.40.0 through 1.42.0.

How is CVE-2026-121819 attacked?

It is attacked over the network.

Am I affected by CVE-2026-121819?

Check whether you run LINE Armeria-Xds at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121819: Armeria armeria-xds symlink traversal in DataSourcePolicy

CVE-2026-121819 · Severity: info · Published 2026-11-06

Armeria's xDS client library is used to securely manage configuration and secrets from a control plane. A flaw in file access controls allows a compromised control plane to read files outside the configured allowed directories by exploiting symbolic links, potentially exposing TLS certificates and credentials. This defeats the security boundary intended to restrict a semi-trusted control plane's access.

Vendors: LINE.

Quick answers

Is CVE-2026-121819 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121819 being exploited in the wild.
How severe is CVE-2026-121819?: Informational severity, published 6 November 2026.
Which products and versions are affected?: LINE Armeria-Xds 1.40.0 through 1.42.0.
Is there a fix for CVE-2026-121819?: Yes: fixed in 1.43.0. Until then: For deployments using restrictive allowedRootDirs, ensure the allow-listed directories contain no symbolic links whose targets lie outside those roots, and restrict file creation permissions under those directories.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-06"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121819 attacked?: It is attacked over the network.
Am I affected by CVE-2026-121819?: Check whether you run LINE Armeria-Xds at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.43.0

For deployments using restrictive allowedRootDirs, ensure the allow-listed directories contain no symbolic links whose targets lie outside those roots, and restrict file creation permissions under those directories.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-06"}]

Technical details

The DataSourcePolicy file confinement check uses lexical path comparison (Path.startsWith) without resolving symbolic links, while the actual file read follows symlinks. An attacker controlling the xDS control plane can name a symbolic link inside an allow-listed directory whose target lies outside that directory, bypassing the confinement check. This is a follow-up bypass of CVE-2026-11752's fix, requiring the target deployment to use restrictive DataSourcePolicy, a symlink to exist with an external target, and control plane compromise.

Affected products

Line armeria-xds 1.40.0 through 1.42.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.