CVE-2026-11751: Armeria-xds vulnerability
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
armeria-xdsto a version that resolves this vulnerability.Fixed in 1.41.0
Event History
Frequently Asked Questions
Which connections are exposed to this issue?
The issue affects xDS-managed upstream connections in armeria-xds when TLS peer verification is silently disabled. Other connection types are not identified in the available data.
What would an attacker need to exploit this vulnerability?
An attacker would need to position themselves to perform a man-in-the-middle attack against an affected xDS-managed upstream connection. The available data does not specify any additional authentication or access requirements.
What is the remediation?
Upgrade armeria-xds to version 1.41.0 or later. Versions prior to 1.41.0 are identified as affected.