Description
kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kgateway-dev | kgateway | >= 2.1.0-agw-cel-rbac, < 2.1.0, < 2.0.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kgateway-dev/kgateway | all versions | — | GO-2025-4094 |
| Go | github.com/kgateway-dev/kgateway/v2 | >= 2.1.0-agw-cel-rbac, < 2.1.0 | 2.1.0 | GHSA-4766-x535-jw3r |
| Go | github.com/kgateway-dev/kgateway/v2 | < 2.0.5 | 2.0.5 | GHSA-4766-x535-jw3r |
| Go | github.com/kgateway-dev/kgateway/v2 | < 2.0.5 · >= 2.1.0-agw-cel-rbac, < 2.1.0 | 2.0.5, 2.1.0 | GO-2025-4094 |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026