Vulnerability · Published Nov 7, 2025 · Assigned by GitHub_M
CVE-2025-64323kgateway is missing xDS authorization
Medium 5.3
In plain English
A medium-severity missing authorization in kgateway from kgateway-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kgateway-dev/kgateway | no fix listed | GO-2025-4094 |
| Go | github.com/kgateway-dev/kgateway/v2 | 2.1.0 | GHSA-4766-x535-jw3r |
| Go | github.com/kgateway-dev/kgateway/v2 | 2.0.5 | GHSA-4766-x535-jw3r |
| Go | github.com/kgateway-dev/kgateway/v2 | 2.0.5, 2.1.0 | GO-2025-4094 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kgateway-dev | kgateway | >= 2.1.0-agw-cel-rbac, < 2.1.0< 2.0.5 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r x_refsource_CONFIRM
- https://github.com/kgateway-dev/kgateway/issues/10651 x_refsource_MISC
- https://github.com/kgateway-dev/kgateway/pull/12471 x_refsource_MISC
- https://github.com/kgateway-dev/kgateway/pull/12535 x_refsource_MISC