CVE-2026-11751: Armeria-xDS TLS Bypass Vulnerability

CVE-2026-11751 Overview

CVE-2026-11751 affects armeria-xds versions prior to 1.41.0. The xDS component silently disables upstream Transport Layer Security (TLS) peer verification under specific conditions. Attackers positioned on the network path can intercept and modify traffic between xDS-managed services without triggering certificate validation errors. The vulnerability enables man-in-the-middle (MITM) attacks against upstream connections managed through the xDS control plane.

Critical Impact
Attackers with network positioning can intercept, read, and modify TLS-protected traffic between xDS-managed services because peer certificate verification is silently bypassed.

Affected Products

armeria-xds versions prior to 1.41.0
Applications using Armeria's xDS integration for upstream service discovery
Services relying on xDS-managed TLS for upstream peer authentication

Discovery Timeline

2026-08-19 - CVE-2026-11751 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-11751

Vulnerability Analysis

The vulnerability resides in the xDS integration layer of the Armeria framework. Armeria uses xDS to dynamically configure upstream clusters, including their TLS parameters. When processing xDS cluster configurations, armeria-xds fails to apply peer verification settings correctly. The client establishes TLS connections without validating that the presented certificate belongs to the intended upstream peer.

This classifies as an Improper Certificate Validation weakness. The client completes the TLS handshake and encrypts traffic, but does not confirm the identity of the remote endpoint. An attacker presenting any valid TLS certificate can terminate the connection and relay traffic to the intended destination.

Root Cause

The root cause is a silent configuration failure inside armeria-xds. Peer verification settings expected from the xDS UpstreamTlsContext are not enforced on the resulting client. No error is surfaced to operators, so services appear to operate normally while TLS trust guarantees are absent.

Attack Vector

Exploitation requires network positioning between the Armeria client and the upstream service. The attacker intercepts the TLS handshake, presents a certificate the client would normally reject, and proxies application traffic. Because verification is disabled, the client accepts the attacker's certificate and processes decrypted plaintext through the MITM proxy. Detailed exploitation conditions are documented in the GitHub Security Advisory and the Line Security Advisory Blog.

// No verified exploitation code available.
// See the vendor advisory for technical reproduction details.

Detection Methods for CVE-2026-11751

Indicators of Compromise

Unexpected TLS certificates presented by upstream services that do not match the expected certificate authority or subject.
Unusual network routing or ARP anomalies between Armeria clients and their xDS-managed upstreams.
xDS-managed connections succeeding despite deliberate certificate mismatches during validation tests.

Detection Strategies

Inventory all deployments of Armeria and identify armeria-xds versions below 1.41.0 through dependency scanning.
Perform active TLS validation tests by presenting an untrusted certificate to Armeria clients and confirming they reject the handshake.
Compare certificate fingerprints observed on the wire against expected upstream service certificates to identify substitutions.

Monitoring Recommendations

Log and alert on TLS handshake metadata, including peer certificate subject and issuer, for xDS-managed upstream connections.
Monitor xDS control plane configuration deltas for changes to UpstreamTlsContext fields that govern peer verification.
Enable network flow monitoring between service mesh components to detect traffic redirection consistent with MITM activity.

How to Mitigate CVE-2026-11751

Immediate Actions Required

Upgrade armeria-xds to version 1.41.0 or later across all applications using xDS-based upstream configuration.
Rotate credentials, tokens, and session material that may have transited xDS-managed TLS connections during the exposure window.
Audit xDS control plane configurations to confirm that peer verification is required for every upstream cluster.

Patch Information

The maintainers released a fix in armeria-xds version 1.41.0. Upgrade instructions and code-level details are available in the GitHub Security Advisory. Additional context is published on the Line Security Advisory Blog.

Workarounds

Restrict Armeria clients to trusted network segments to reduce opportunity for MITM positioning until patching is complete.
Enforce mutual TLS (mTLS) at the service mesh or sidecar layer so peer identity is verified outside of armeria-xds.
Pin upstream certificates or certificate authorities at the application layer where feasible until upgrading.

bash

# Update the armeria-xds dependency to the patched release
# Gradle example
# implementation 'com.linecorp.armeria:armeria-xds:1.41.0'

# Maven example
# <dependency>
#   <groupId>com.linecorp.armeria</groupId>
#   <artifactId>armeria-xds</artifactId>
#   <version>1.41.0</version>
# </dependency>