A vulnerability exists in the armeria-xds component of LY Corporation's Armeria where the DataSourcePolicy validates file inclusion by checking the filename directly rather than resolving symbolic links. When a symlink inside an allowed directory points to a location outside that root, the xDS client can read arbitrary files beyond the intended boundary. In deployments that use a credential injector, header-compatible text secrets may be conveyed to an attacker‑observable upstream, potentially leaking secrets. This flaw allows a compromised or semi‑trusted xDS control plane to exfiltrate sensitive files and secrets.

The affected product is LY Corporation's Armeria, specifically the armeria‑xds module in versions 1.40.0 through 1.42.0. Any deployment that relies on these versions when communicating with an xDS control plane is vulnerable.

The CVSS score of 5.9 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control or influence the xDS control plane that the Armeria client contacts. By providing a malicious configuration that includes a symlink to a protected file, the attacker can force the client to read and transfer that file to the control plane or to an upstream service that observes secret headers. The impact is confined to file disclosure and potential secret leakage, but it can be significant if privileged files are accessed.