Vulnerability-Lookup

CVE-2025-64323 (GCVE-0-2025-64323)

Vulnerability from cvelistv5 – Published: 2025-11-07 03:18 – Updated: 2025-11-07 17:50

Title

kgateway is missing xDS authorization

Summary

kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M

References

URL

Tags

	https://github.com/kgateway-dev/kgateway/security…	x_refsource_CONFIRM
	https://github.com/kgateway-dev/kgateway/issues/10651	x_refsource_MISC
	https://github.com/kgateway-dev/kgateway/pull/12471	x_refsource_MISC
	https://github.com/kgateway-dev/kgateway/pull/12535	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	kgateway-dev	kgateway	Affected: >= 2.1.0-agw-cel-rbac, < 2.1.0 Affected: < 2.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64323",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-07T17:49:21.697473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-07T17:50:53.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kgateway",
          "vendor": "kgateway-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0-agw-cel-rbac, \u003c 2.1.0"
            },
            {
              "status": "affected",
              "version": "\u003c 2.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-07T03:18:48.993Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r"
        },
        {
          "name": "https://github.com/kgateway-dev/kgateway/issues/10651",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kgateway-dev/kgateway/issues/10651"
        },
        {
          "name": "https://github.com/kgateway-dev/kgateway/pull/12471",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kgateway-dev/kgateway/pull/12471"
        },
        {
          "name": "https://github.com/kgateway-dev/kgateway/pull/12535",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kgateway-dev/kgateway/pull/12535"
        }
      ],
      "source": {
        "advisory": "GHSA-4766-x535-jw3r",
        "discovery": "UNKNOWN"
      },
      "title": "kgateway is missing xDS authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-64323",
    "datePublished": "2025-11-07T03:18:48.993Z",
    "dateReserved": "2025-10-30T17:40:52.027Z",
    "dateUpdated": "2025-11-07T17:50:53.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-64323\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-11-07T04:15:47.243\",\"lastModified\":\"2025-11-12T16:20:22.257\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/kgateway-dev/kgateway/issues/10651\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kgateway-dev/kgateway/pull/12471\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kgateway-dev/kgateway/pull/12535\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-64323\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-07T17:49:21.697473Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-11-07T17:49:53.336Z\"}}], \"cna\": {\"title\": \"kgateway is missing xDS authorization\", \"source\": {\"advisory\": \"GHSA-4766-x535-jw3r\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"kgateway-dev\", \"product\": \"kgateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.1.0-agw-cel-rbac, \u003c 2.1.0\"}, {\"status\": \"affected\", \"version\": \"\u003c 2.0.5\"}]}], \"references\": [{\"url\": \"https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r\", \"name\": \"https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/kgateway-dev/kgateway/issues/10651\", \"name\": \"https://github.com/kgateway-dev/kgateway/issues/10651\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/kgateway-dev/kgateway/pull/12471\", \"name\": \"https://github.com/kgateway-dev/kgateway/pull/12471\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/kgateway-dev/kgateway/pull/12535\", \"name\": \"https://github.com/kgateway-dev/kgateway/pull/12535\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-11-07T03:18:48.993Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-64323\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-07T17:50:53.540Z\", \"dateReserved\": \"2025-10-30T17:40:52.027Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-11-07T03:18:48.993Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-64323

Vulnerability from fkie_nvd - Published: 2025-11-07 04:15 - Updated: 2025-11-12 16:20

Severity ?

5.3 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kgateway-dev/kgateway/issues/10651
	security-advisories@github.com	https://github.com/kgateway-dev/kgateway/pull/12471
	security-advisories@github.com	https://github.com/kgateway-dev/kgateway/pull/12535
	security-advisories@github.com	https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0."
    },
    {
      "lang": "es",
      "value": "kgateway es un Gateway de API e IA nativo de la nube. Las versiones 2.0.4 e inferiores y de la 2.1.0-agw-cel-rbac a la 2.1.0-rc.2 carecen de autenticaci\u00f3n, lo que permite a cualquier cliente con acceso de red sin restricciones al puerto xDS recuperar datos de configuraci\u00f3n potencialmente sensibles, incluyendo datos de certificados, informaci\u00f3n de servicios de backend, reglas de enrutamiento y metadatos de cl\u00faster. Este problema se resuelve en las versiones 2.0.5 y 2.1.0."
    }
  ],
  "id": "CVE-2025-64323",
  "lastModified": "2025-11-12T16:20:22.257",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-11-07T04:15:47.243",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kgateway-dev/kgateway/issues/10651"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kgateway-dev/kgateway/pull/12471"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kgateway-dev/kgateway/pull/12535"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4766-X535-JW3R

Vulnerability from github – Published: 2025-11-04 18:39 – Updated: 2025-11-17 21:38

Summary

kgateway is missing xDS authorization

Details

Summary

The xDS interface in Kgateway versions 2.0.0 through 2.0.4 lacks authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata.

Description

Impact

Kgateway xDS interface did not have authorization, so anonymous clients with unrestricted network access could gain access to the xDS data. This could expose sensitive information about your gateway configuration, certificate data, backend services, and routing topology to unauthorized parties.

Patches

Upgrade to version 2.0.5 or 2.1.0. These versions enable JWT-based authentication for the xDS interface by default, ensuring that only authenticated clients can access the xDS configuration data.

Workarounds

If immediate upgrade is not possible, NetworkPolicies can be used to block access to kgateway's xDS port, restricting network access to only trusted sources.

References

Fix in 2.1.0: https://github.com/kgateway-dev/kgateway/pull/12471
Backport to 2.0.5: https://github.com/kgateway-dev/kgateway/pull/12535
Related issue: https://github.com/kgateway-dev/kgateway/issues/10651

Credits

Kindly reported by @rikatz

For More Information

If you have any questions or comments about this advisory, please reach out in slack https://cloud-native.slack.com/archives/C080D3PJMS4

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kgateway-dev/kgateway/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0-agw-cel-rbac"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kgateway-dev/kgateway/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64323"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-04T18:39:31Z",
    "nvd_published_at": "2025-11-07T04:15:47Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe xDS interface in Kgateway versions 2.0.0 through 2.0.4 lacks authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata.\n\n## Description\n\n### Impact\n\nKgateway xDS interface did not have authorization, so anonymous clients with unrestricted network access could gain access to the xDS data. This could expose sensitive information about your gateway configuration, certificate data, backend services, and routing topology to unauthorized parties.\n\n### Patches\n\nUpgrade to version 2.0.5 or 2.1.0. These versions enable JWT-based authentication for the xDS interface by default, ensuring that only authenticated clients can access the xDS configuration data.\n\n### Workarounds\n\nIf immediate upgrade is not possible, NetworkPolicies can be used to block access to kgateway\u0027s xDS port, restricting network access to only trusted sources.\n\n## References\n\n- Fix in 2.1.0: https://github.com/kgateway-dev/kgateway/pull/12471\n- Backport to 2.0.5: https://github.com/kgateway-dev/kgateway/pull/12535\n- Related issue: https://github.com/kgateway-dev/kgateway/issues/10651\n\n## Credits\n\nKindly reported by @rikatz\n\n## For More Information\n\nIf you have any questions or comments about this advisory, please reach out in slack https://cloud-native.slack.com/archives/C080D3PJMS4",
  "id": "GHSA-4766-x535-jw3r",
  "modified": "2025-11-17T21:38:28Z",
  "published": "2025-11-04T18:39:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64323"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kgateway-dev/kgateway/issues/10651"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kgateway-dev/kgateway/pull/12471"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kgateway-dev/kgateway/pull/12535"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kgateway-dev/kgateway"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kgateway is missing xDS authorization"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-64323 (GCVE-0-2025-64323)

FKIE_CVE-2025-64323

GHSA-4766-X535-JW3R

Summary

Description

Impact

Patches

Workarounds

References

Credits

For More Information

Tags

Sightings

Nomenclature