Plants prevent disease by passively and actively protecting potential entry routes against invading microbes. For example, the plant immune system actively guards roots, wounds, and stomata. How plants prevent vascular disease upon bacterial entry via guttation fluids excreted from specialized glands at the leaf margin remains largely unknown. These so-called hydathodes release xylem sap when root pressure is too high. By studying hydathode colonization by both hydathode-adapted (Xanthomonas campestris pv. campestris) and non-adapted pathogenic bacteria (Pseudomonas syringae pv. tomato) in immunocompromised Arabidopsis mutants, we show that the immune hubs BAK1 and EDS1-PAD4-ADR1 restrict bacterial multiplication in hydathodes. Both immune hubs effectively confine bacterial pathogens to hydathodes and lower the number of successful escape events of an hydathode-adapted pathogen toward the xylem. A second layer of defense, which is dependent on the plant hormones’ pipecolic acid and to a lesser extent on salicylic acid, reduces the vascular spread of the pathogen. Thus, besides glands, hydathodes represent a potent first line of defense against leaf-invading microbes. Display omitted •Adapted and non-adapted bacterial pathogens colonize hydathodes via guttation•Only adapted bacteria escape from hydathodes toward the xylem and not the apoplast•The plant immune hubs BAK1 and EDS1-PAD4-ADR1 confine bacteria inside hydathodes•Pipecolic acid and salicylic acid suppress bacterial spread along leaf veins How do plants protect themselves against vein diseases caused by invasive bacteria? Paauw et al. investigate this question for a particular entry route, that is, hydathodes. They show that these over-pressure valves for excess root pressure are guarded by well-characterized components of the plant immune system, such as BAK1, ADR1, and EDS1.