Kgateway versions prior to 2.0.5 and certain 2.1.0 pre-release versions contain a vulnerability in the transformation policy template feature that allows users with TrafficPolicy creation permissions to read arbitrary files from the dataplane container filesystem. This can expose configuration files, contents of custom mounted volumes, and any files accessible to the dataplane container process. The vulnerability has been fixed in versions 2.0.5 and 2.1.0.