Armeria EUVD-2026-62218

Exploitation requires that the application uses the armeria-xds module and that upstream TLS peer verification is in the silently-disabled state for the targeted xDS-managed upstream connection (the advisory describes verification being silently turned off for xDS-configured upstreams). The attacker must additionally hold an active man-in-the-middle position on the network path between the Armeria client and that upstream - this is the AT:P attack-requirement and AC:H high-complexity limiter. Limiting factors: only xDS-managed upstream connections are in scope (deployments without armeria-xds or without xDS-driven upstream TLS are unaffected), the attacker needs network path interception rather than direct access to the host, and the flaw is fixed in 1.41.0 so patched deployments are not exposed. No end-user interaction is required (UI:N) and no authentication to the target is required (PR:N).

The published CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) scores 9.1 (Critical), reflecting high confidentiality and integrity impact with no availability impact and no scope/subsequent-system change. Two metrics meaningfully constrain real-world risk: AC:H and AT:P indicate the attack is not trivially repeatable and requires specific attack prerequisites - namely an active man-in-the-middle position on the upstream path, which is the classic limiting factor for MITM bugs. There is no EPSS score, no KEV listing, and no evidence of a public POC in the provided data, so this is best treated as a serious latent trust-boundary weakness rather than an actively exploited threat. The 9.1 magnitude is driven by impact severity (full read/tamper of upstream traffic), not by ease or breadth of exploitation; prioritize patching wherever armeria-xds terminates TLS to sensitive upstreams, but note exploitation realistically requires network-adjacency or path control that a strong internal network posture already limits.

An attacker who can position themselves on the network path between an armeria-xds client and one of its xDS-managed upstream services (for example a compromised host, rogue router, or ARP/DNS spoofer inside the service-mesh network) presents a fraudulent server certificate. Because peer verification is silently disabled for that upstream, the Armeria client accepts the connection and the attacker transparently proxies, decrypts, and modifies application traffic. No public POC is identified at time of analysis, and the CVSS AC:H/AT:P metrics reflect that the attacker must already control or intercept the connection path.