CVE-2026-53718

Received Received - Intake

Authorization Bypass in Envoy Gateway via Extension-Managed BackendRef

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-53718

Affected Vendors & Products

Vendor	Product	Version / Range
envoy	gateway	to 1.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Envoy Gateway before versions 1.7.4 and 1.8.1 allows an HTTPRoute to use a custom backendRef pointing to a backend resource in another namespace without a required ReferenceGrant in the target namespace. This bypasses the Gateway API's cross-namespace authorization model, letting the route owner bind to and use resources without consent from the backend namespace owner.

Impact Analysis

An attacker with access to create HTTPRoutes could exploit this to redirect traffic to unauthorized backends in other namespaces, potentially leading to data exfiltration, service disruption, or unauthorized access to sensitive resources.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data isolation between namespaces or tenants, such as those in GDPR (data protection) or HIPAA (healthcare data privacy). Unauthorized backend access risks exposing regulated data.

Mitigation Strategies

Upgrade Envoy Gateway to version 1.7.4 or 1.8.1 or later to address the vulnerability. Review HTTPRoute configurations to ensure they do not use extension-managed custom backendRef without proper ReferenceGrant in the target namespace.

Hi! I’m here to help you understand CVE-2026-53718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70