Armeria, the HTTP/2-based framework from LY Corporation, contains an issue in its xDS module between versions 1.38.0 and 1.39.0. The "DataSourceStream" component accepts file names and environment variable references that are supplied by the control‑plane side without any access checks. As a result, an attacker who can control or compromise the xDS control‑plane can request the client to resolve and read arbitrary files and environment variables on the host. The disclosed data may include configuration files, credentials, or other sensitive information, potentially allowing an attacker to gain insight into the system’s internal state or secrets.

LY Corporation Armeria, versions 1.38.0 through 1.39.0, used by applications that rely on the xDS module for dynamic configuration.

The CVSS score of 5.9 indicates a moderate severity. EPSS data is not available, so the likelihood of exploit is not quantifiable from existing metrics, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires the attacker to control or compromise the xDS control‑plane and have it communicate with an Armeria client; from there the client can read any local file or environment variable, providing potential disclosure of sensitive information.