Path Traversal in Envoy Gateway

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-53713

Affected Vendors & Products

Vendor	Product	Version / Range
envoy	gateway	to 1.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

Envoy Gateway before versions 1.7.4 and 1.8.1 has a path validation flaw in Lua submitted through EnvoyExtensionPolicy. The to_absolute_normalized_path function fails to collapse redundant path separators before checking critical paths. This allows attackers to bypass validation and read arbitrary files from the gateway controller pod, including sensitive data like Kubernetes service-account tokens and TLS certificates.

Impact Analysis

This vulnerability can allow unauthorized access to sensitive files on the gateway controller pod. Exposed data may include Kubernetes credentials, TLS certificates, and environment variables, which could be used to gain control over the Kubernetes API Server or Gateway xDS server, leading to potential data breaches or system compromise.

Mitigation Strategies

Upgrade Envoy Gateway to version 1.7.4 or 1.8.1 or later to address the vulnerability in the path validation logic.

Hi! I’m here to help you understand CVE-2026-53713. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70