Is CVE-2026-121821 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121821 being exploited in the wild.

How severe is CVE-2026-121821?

Informational severity, published 6 November 2026.

Which products and versions are affected?

LY Corporation Armeria 0.84.0 to 1.42.0.

Is there a fix for CVE-2026-121821?

Yes: fixed in 1.43.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121821 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121821?

Check whether you run LY Corporation Armeria at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121821: LY armeria CORS path restriction bypass

CVE-2026-121821 · Severity: info · Published 2026-11-06

Armeria is a Java framework for building web services and microservices. A vulnerability in its CORS (Cross-Origin Resource Sharing) policy implementation causes the framework to apply security policies to all paths instead of only the configured allowed paths. An attacker can exploit this by luring an authenticated user to a malicious website, which then reads sensitive data from API endpoints that should have been restricted.

Vendors: LY Corporation.

Quick answers

Is CVE-2026-121821 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121821 being exploited in the wild.
How severe is CVE-2026-121821?: Informational severity, published 6 November 2026.
Which products and versions are affected?: LY Corporation Armeria 0.84.0 to 1.42.0.
Is there a fix for CVE-2026-121821?: Yes: fixed in 1.43.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121821 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121821?: Check whether you run LY Corporation Armeria at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.43.0

Technical details

The vulnerability exists in CorsService when configured with builderForAnyOrigin() or @CorsDecorator(origins = "*"): the route() and pathPatterns configuration is ignored, and the CORS policy is applied globally. Combined with allowCredentials(), the server reflects the request Origin header with Access-Control-Credentials: true, permitting credentialed cross-origin requests to all paths. An attacker-controlled website can use fetch() with credentials to read authenticated responses from excluded paths.

Affected products

LY Corporation armeria 0.84.0 to 1.42.0

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.