GHSA-4766-x535-jw3r

Source

https://github.com/advisories/GHSA-4766-x535-jw3r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-4766-x535-jw3r/GHSA-4766-x535-jw3r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4766-x535-jw3r

Aliases

Published

2025-11-04T18:39:31Z

Modified

2025-11-17T21:38:28Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

kgateway is missing xDS authorization

Details

Summary

The xDS interface in Kgateway versions 2.0.0 through 2.0.4 lacks authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata.

Description

Impact

Kgateway xDS interface did not have authorization, so anonymous clients with unrestricted network access could gain access to the xDS data. This could expose sensitive information about your gateway configuration, certificate data, backend services, and routing topology to unauthorized parties.

Patches

Upgrade to version 2.0.5 or 2.1.0. These versions enable JWT-based authentication for the xDS interface by default, ensuring that only authenticated clients can access the xDS configuration data.

Workarounds

If immediate upgrade is not possible, NetworkPolicies can be used to block access to kgateway's xDS port, restricting network access to only trusted sources.

References

Fix in 2.1.0: https://github.com/kgateway-dev/kgateway/pull/12471
Backport to 2.0.5: https://github.com/kgateway-dev/kgateway/pull/12535
Related issue: https://github.com/kgateway-dev/kgateway/issues/10651

Credits

Kindly reported by @rikatz

For More Information

If you have any questions or comments about this advisory, please reach out in slack https://cloud-native.slack.com/archives/C080D3PJMS4

Database specific

{
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2025-11-07T04:15:47Z",
    "cwe_ids": [
        "CWE-862"
    ],
    "github_reviewed_at": "2025-11-04T18:39:31Z"
}

References

Affected packages

Go / github.com/kgateway-dev/kgateway/v2

Package

Name: github.com/kgateway-dev/kgateway/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/kgateway-dev/kgateway/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.1.0-agw-cel-rbac

Fixed

2.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-4766-x535-jw3r/GHSA-4766-x535-jw3r.json"

Go / github.com/kgateway-dev/kgateway/v2

Package

Name: github.com/kgateway-dev/kgateway/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/kgateway-dev/kgateway/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-4766-x535-jw3r/GHSA-4766-x535-jw3r.json"