CVE-2026-53714

Received Received - Intake

Authentication Bypass in Envoy Gateway

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC unauthenticated. The streaming interceptor also authenticates only discoveryv3.DeltaDiscoveryRequest messages; a discoveryv3.DiscoveryRequest used by the State-of-the-World protocol fails the type assertion and returns success without JWT validation. Any pod that can reach port 18000 can use the unauthenticated unary or State-of-the-World paths to retrieve TLS private keys through StreamSecrets, all xDS resources through StreamAggregatedResources, backend endpoints through StreamClusters or StreamEndpoints, and routing configuration through StreamRoutes or StreamListeners. This issue is fixed in versions 1.7.4 and 1.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-53714

Affected Vendors & Products

Vendor	Product	Version / Range
envoy	gateway	to 1.7.4 (inc)
envoy	gateway	to 1.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Envoy Gateway before versions 1.7.4 and 1.8.1 has a flaw in its xDS gRPC server when configured in GatewayNamespaceMode. The server installs a JWT StreamInterceptor but lacks a UnaryInterceptor, leaving unary Fetch RPCs unauthenticated. The streaming interceptor only validates discoveryv3.DeltaDiscoveryRequest messages, failing to authenticate discoveryv3.DiscoveryRequest used by the State-of-the-World protocol. This allows unauthenticated access to sensitive data.

Detection Guidance

Check if Envoy Gateway is running in GatewayNamespaceMode with provider.kubernetes.deploy.type=GatewayNamespace. Verify if port 18000 is exposed and accessible. Test unary Fetch RPCs and State-of-the-World protocol paths for unauthenticated access to xDS resources.

Impact Analysis

An attacker who can reach port 18000 can retrieve TLS private keys, all xDS resources, backend endpoints, and routing configuration without authentication. This could lead to data breaches, unauthorized access to systems, or interception of sensitive communications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance with data protection regulations, leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Envoy Gateway to version 1.7.4 or 1.8.1 or later. If upgrading is not possible, disable GatewayNamespaceMode or restrict access to port 18000 using network policies or firewalls.

Hi! I’m here to help you understand CVE-2026-53714. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70