-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/kgateway-dev/kgateway/v2 | go | < 2.0.5 | 2.0.5 |
| github.com/kgateway-dev/kgateway/v2 | go | >= 2.1.0-agw-cel-rbac, < 2.1.0 | 2.1.0 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability exists within the envoy-gloo dependency, which is a pre-compiled binary consumed by Kgateway. The provided patches for Kgateway only show updates to the version of this dependency. Without access to the source code of the vulnerable envoy-gloo versions, it is not possible to identify the specific vulnerable functions. The vulnerability is related to the transformation policy template feature, which allows for path traversal and arbitrary file reads from the dataplane container. The fix was to update the transformation filter in envoy-gloo to prevent this file access.
Ongoing coverage of React2Shell