Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/kgateway-dev/kgateway/v2 < 2.0.5; >= 2.1.0-agw-cel-rbac, < 2.1.0
Fixed in
2.0.52.1.0· Vendor fix available
Issue
The transformation policy template feature in Kgateway versions through 2.0.4 allows users with TrafficPolicy creation permissions to craft transformations that read and expose arbitrary files from the dataplane container filesystem. Description Impact Users with permissions to create a TrafficPolicy can create a transformation that returns files from within the dataplane container. While no secrets are mounted to the container by default, users who mount custom volumes to the dataplane should be aware of potential data exposure through this vulnerability. This could allow unauthorized access to: - Configuration files within the container - Custom mounted volumes and their contents - Any files accessible to the dataplane container process Note: Updated availability score to high, as under some configurations this can prevent xDS updates. Patches Upgrade to version 2.0.5 or 2.1.0. These versions include an updated transformation filter in envoy-gloo that prevents file access…
Recommended action: Upgrade to 2.1.0 or 2.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/kgateway-dev/kgateway/v2 >= 2.1.0-agw-cel-rbac, < 2.1.0; < 2.0.5
Fixed in
2.0.52.1.0· Vendor fix available
Issue
The xDS interface in Kgateway versions 2.0.0 through 2.0.4 lacks authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. Description Impact Kgateway xDS interface did not have authorization, so anonymous clients with unrestricted network access could gain access to the xDS data. This could expose sensitive information about your gateway configuration, certificate data, backend services, and routing topology to unauthorized parties. Patches Upgrade to version 2.0.5 or 2.1.0. These versions enable JWT-based authentication for the xDS interface by default, ensuring that only authenticated clients can access the xDS configuration data. Workarounds If immediate upgrade is not possible, NetworkPolicies can be used to block access to kgateway's xDS port, restricting network access to only trusted sources.…
Recommended action: Upgrade to 2.1.0 or 2.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.