Log in Start free

Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M

CVE-2026-53714Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode

High 7.4

In plain English

A high-severity missing authentication in gateway from envoyproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.3%top 71.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC unauthenticated. The streaming interceptor also authenticates only discoveryv3.DeltaDiscoveryRequest messages; a discoveryv3.DiscoveryRequest used by the State-of-the-World protocol fails the type assertion and returns success without JWT validation. Any pod that can reach port 18000 can use the unauthenticated unary or State-of-the-World paths to retrieve TLS private keys through StreamSecrets, all xDS resources through StreamAggregatedResources, backend endpoints through StreamClusters or StreamEndpoints, and routing configuration through StreamRoutes or StreamListeners. This issue is fixed in versions 1.7.4 and 1.8.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/envoyproxy/gateway1.8.1GHSA-22xc-xg2r-9j7v
Gogithub.com/envoyproxy/gateway1.7.4GHSA-22xc-xg2r-9j7v
Gogithub.com/envoyproxy/gateway1.7.4, 1.8.1GO-2026-6003

Affected products (as reported)

VendorProductVersions
envoyproxy gateway < 1.7.4>= 1.8.0-rc.0, < 1.8.1

Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References