CVE-2026-121821 Details
Description
A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.
A vulnerability exists in Armeria versions 0.84.0 prior to 1.43.0, where CORS policies allowing any origin do not properly enforce path restrictions. This flaw enables an attacker-controlled website to access sensitive data from excluded paths, but only when the victim's browser sends authentication credentials and CORS is configured to allow credentials.
Update Armeria to version 1.43.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/line/armeria/security/advisories/GHSA-386q-mrg6-jfj8 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://line.github.io/security-advisory-blog/CVE-2026-121821/ | [email protected] | AdvisoryRemedy |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| LINE Armeria | >= 0.84.0, < 1.43.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |