CVE-2026-53719mediumCWE-476

CVE-2026-53719: medium-severity vulnerability in envoyproxy gateway

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

Published · Updated

Follow this CVE+ Monitor gateway+ Monitor github.com/envoyproxy/gateway

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.7%
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization. The persistent object triggers the panic on every reconcile; recovery in message/watchutil.go keeps the process alive but unwinds the runner/runner.go handle callback, stalling controller-wide xDS and infrastructure intermediate-representation publishing until an administrator deletes the object. The data plane continues to serve the last known good configuration while publication is stalled. This issue is fixed in versions 1.7.4 and 1.8.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
envoyproxy · gateway
Related CVEs — envoyproxy gateway

In the same product, most dangerous first.

CVE-2026-53716MEDIUMEnvoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitEPSS 0.7%CVE-2026-53717MEDIUMEnvoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerEPSS 0.7%CVE-2026-22771HIGHEnvoy Extension Policy lua scripts injection causes arbitrary command executionEPSS 0.6%CVE-2026-53715MEDIUMEnvoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockEPSS 0.5%CVE-2026-53713CRITICALEnvoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret DisclosureEPSS 0.4%CVE-2025-24030HIGHEnvoy Admin Interface Exposed through prometheus metrics endpointEPSS 0.4%