CVEvulnerability

CVE-2025-64323

5.3 MEDIUM Published 2025-11-07 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-11-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862

Description

kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References