CVE-2025-64323 json
kgateway is missing xDS authorization
published 2025-11-04 12 mo ago modified 2026-06-17 4 mo ago also GHSA-4766-x535-jw3r , GO-2025-4094 , EUVD-2025-37852
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.
Patch / fix
- go github.com/kgateway-dev/kgateway/v2 2.0.5, 2.1.0
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/kgateway-dev/kgateway#12471 pull request
- github.com/kgateway-dev/kgateway#12535 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/kgateway-dev/kgateway/v2 | >=2.1.0-agw-cel-rbac, <2.1.0 <2.0.5 |
2.1.0 2.0.5 |
| go | github.com/kgateway-dev/kgateway | all versions |
no fix listed |
Affected products
- kgateway-dev kgateway
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/kgateway-dev/kgateway/pull/12471
web, patch
-
github.com
/kgateway-dev/kgateway/pull/12535
web, patch
-
github.com
/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r
web, advisory
-
github.com
/kgateway-dev/kgateway/issues/10651
web, report
-
nvd.nist.gov
/vuln/detail/CVE-2025-64323
advisory
-
github.com
/kgateway-dev/kgateway
package
Sources
- CVE List CVE-2025-64323
- GitHub Advisory GHSA-4766-x535-jw3r
- NVD CVE-2025-64323
- OSV GO-2025-4094
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.