CVE-2026-53714: Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and

Executive brief

Envoy Gateway, a tool used to manage network traffic in Kubernetes environments, contains a security flaw when configured in a specific multi-tenant mode. An attacker with access to the internal network can bypass security checks to steal sensitive information, including TLS private keys and internal routing rules. This could allow an unauthorized party to intercept encrypted traffic or gain deep insight into the internal network structure.

Technical details

Envoy Gateway is vulnerable to an authentication bypass in its xDS gRPC server when running in GatewayNamespaceMode. The server lacks a UnaryInterceptor for JWT authentication, leaving Fetch RPC methods completely unauthenticated. Furthermore, the existing StreamInterceptor fails to validate tokens for State-of-the-World (SotW) DiscoveryRequests due to an incorrect type assertion that only checks for DeltaDiscoveryRequests. An attacker within the cluster network can exploit these omissions to access sensitive xDS resources, including Secrets (SDS), Clusters (CDS), and Routes (RDS). The issue is fixed in versions 1.8.1 and 1.7.4.

Affected products

• envoyproxy gateway >= 1.8.0-rc.0, < 1.8.1; < 1.7.4

Timeline

• 2026-06-05: disclosed
• 2026-07-16: advisory
• 2026-07-16: patched

References

• https://api.github.com/users/cnvergence
• https://github.com/cnvergence
• https://api.github.com/users/cnvergence/gists%7B/gist_id%7D
• https://api.github.com/users/cnvergence/repos
• https://avatars.githubusercontent.com/u/26778356?v=4
• https://api.github.com/users/cnvergence/events%7B/privacy%7D