CVE-2026-11751 - A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections

Back Back to CVE browser

CRITICAL

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections

Published Aug 19, 2026

9.1

CRITICAL

CVSS 4.0

EPSS 0.32%

Description

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62218		Advisory
https://github.com/line/armeria/security/advisories/GHSA-6qfw-3mvj-m6v5
https://line.github.io/security-advisory-blog/CVE-2026-11751/