The vulnerability CVE-2026-11752 affects the armeria-xds module of LY Corporation's Armeria product, versions 1.38.0 through 1.39.0. The DataSourceStream component improperly handles filenames and environment variables supplied by the xDS control plane, enabling unauthorized reading of local files and environment variables on the client system. This issue is classified under CWE-73 (External Control of File Name or Path). The CVSS 4.0 base score is 5.9, indicating medium severity, with network attack vector, high attack complexity, and requiring high privileges on the client side. There is no vendor advisory or patch available at this time.

An attacker controlling or partially trusted in the xDS control plane can exploit this vulnerability to read arbitrary files and environment variables on the xDS client host. This could lead to unauthorized disclosure of sensitive information stored locally or in environment variables. The attack requires high privileges on the client and has high complexity, limiting exploitability. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the xDS control plane to trusted entities only and monitor for suspicious activity related to xDS communications. Avoid deploying vulnerable versions in untrusted environments.