Junglewise Threat Intelligence

CVE-2026-65919: Meshery unauthenticated arbitrary file read in system endpoints

CVE-2026-65919 · Severity: high · CVSS 7.5 · Published 2026-07-23

Executive brief

Meshery, a cloud-native management platform, contains a security flaw that allows unauthorized users to read sensitive files from the server's host system. By sending specially crafted requests to certain system endpoints, an attacker could access configuration files, credentials, or other private data. This could lead to a full compromise of the management platform and the infrastructure it controls.

Technical details

An unauthenticated arbitrary file read vulnerability exists in Meshery's server component within the ViewHandler and DownloadHandler functions. The /api/system/fileView and /api/system/fileDownload endpoints accept a 'file' query parameter that is passed directly to os.Open without sufficient path validation or sanitization. Because these routes are registered without authentication (NoAuth) in the default deployment, a remote attacker can use absolute paths or directory traversal sequences (e.g., ../) to retrieve sensitive files from the underlying host filesystem. The issue was addressed in version 1.0.57 by implementing a SafeFilePath utility that validates paths against an allowlist of directories and resolves symlinks.

Affected products

  • Meshery Meshery < 1.0.57

Timeline

  • 2026-06-15: disclosed: Vulnerability reported via GitHub issue #20076
  • 2026-07-16: patched: Fix merged into master branch via PR #20133
  • 2026-07-17: advisory: Version 1.0.57 released with security fixes
  • 2026-07-23: advisory: CVE-2026-65919 published to NVD

References