Auth bypass in Kgateway-Dev Kgateway
CVE-2025-64323
kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster metadata. This issue is solved in versions 2.0.5 and 2.1.0.
Vulnerability class: Broken Access Control
EPSS: 0.002 (5.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Kgateway-dev Kgateway — versions >= 2.1.0-agw-cel-rbac, < 2.1.0, < 2.0.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-64323?
- CVE-2025-64323 is a medium-severity vulnerability in Kgateway-Dev Kgateway, classified under Missing Authorization. CVSS score: 5.3/10. Published 2025-11-07.
- How severe is CVE-2025-64323?
- Medium severity. CVSS v3 base score is 5.3 out of 10.