Executive brief
Envoy Gateway is a tool used to manage network traffic for cloud-native applications. A vulnerability exists where a user with limited permissions can crash the management component by providing a specific configuration that is missing required authorization details. While existing network traffic continues to flow, this crash prevents administrators from making any further updates or changes to the network configuration until the problematic entry is manually removed.
Technical details
A NULL pointer dereference (CWE-476) exists in Envoy Gateway's gatewayapi runner. When a SecurityPolicy targets a TCPRoute and the 'spec.authorization' field is omitted, the reconcile process triggers a panic. While a recovery mechanism prevents the entire process from exiting, it unwinds the handle() callback, effectively stalling xDS and Infrastructure Intermediate Representation (IR) publishing controller-wide. This allows a namespace-scoped tenant with permissions to create these resources to deterministically block all configuration updates. The issue is fixed in versions 1.7.4 and 1.8.1.
Affected products
- Envoy Proxy Envoy Gateway >= 1.8.0-rc.0, < 1.8.1; < 1.7.4
Timeline
- 2026-06-05: disclosed
- 2026-07-16: advisory
- 2026-07-16: patched