Skip to main content

Missing Authorization

CVE-2025-64323

Medium
5.3/10

Summary

kgateway is a Cloud-Native API and AI Gateway. Versions through 2.0.4 and 2.1.0-agw-cel-rbac through 2.1.0-rc.1, lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0rc2.

  • HIGH
  • ADJACENT_NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published