Threats tagged 'ghsa-4766-x535-jw3r'

Kgateway versions 2.0.0 through 2.0.4 have an unauthenticated xDS interface, allowing any client with network access to retrieve sensitive configuration data such as certificates, backend service details, routing rules, and cluster metadata. This vulnerability is fixed in versions 2.0.5 and 2.1.0, which enable JWT-based authentication by default for the xDS interface. Until upgraded, network policies can restrict access to the xDS port to trusted sources.