—
GO-2025-4094
kgateway is missing xDS authorization in github.com/kgateway-dev/kgateway
Quick fix
GO-2025-4094 — github.com/kgateway-dev/kgateway/v2: upgrade to the fixed version with the command below.
go get github.com/kgateway-dev/kgateway/v2@v2.0.5Details
kgateway is missing xDS authorization in github.com/kgateway-dev/kgateway
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/kgateway-dev/kgateway
Introduced in:
0No fixed version published yet for github.com/kgateway-dev/kgateway (go modules). Pin to a known-safe version or switch to an alternative.
Go/github.com/kgateway-dev/kgateway/v2
Introduced in:
0Fixed in: 2.0.5Fix
go get github.com/kgateway-dev/kgateway/v2@v2.0.5References
- https://github.com/kgateway-dev/kgateway/security/advisories/GHSA-4766-x535-jw3r[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2025-64323[ADVISORY]
- https://github.com/kgateway-dev/kgateway/pull/12471[FIX]
- https://github.com/kgateway-dev/kgateway/pull/12535[FIX]
- https://github.com/kgateway-dev/kgateway/issues/10651[REPORT]