github.com/kgateway-dev/kgateway

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

Medium 5.3

CVE-2025-64323

kgateway is missing xDS authorization

kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data in…

kgateway-dev kgateway github.com/kgateway-dev/kgateway github.com/kgateway-dev/kgateway/v2 Go

Nov 7, 2025
Medium 6.3

GHSA-5pmx-7r6r-wfqq

Kgateway transformation policy template can emit files from the container

## Summary The transformation policy template feature in Kgateway versions through 2.0.4 allows users with TrafficPolicy creation permissions to craft transformations that read and expose arbitrary files from the dataplane container filesystem. ## Description…

github.com/kgateway-dev/kgateway github.com/kgateway-dev/kgateway/v2 Go

Nov 4, 2025