Path traversal in Envoy Gateway via double-slash bypass (CVE-2026-53713)

CVE-2026-53713 is a critical improper input validation vulnerability in Envoy Gateway's `to_absolute_normalized_path` function (security.lua:28-43) that fails to collapse redundant path separators (`//` to `/`). This allows Lua code submitted as an `EnvoyExtensionPolicy` to bypass the `is_critical_path` check using double-slash path variants, enabling arbitrary file reads from the gateway controller pod's filesystem during Strict validation. Sensitive files accessible via this bypass include Kubernetes service account tokens, TLS certificates, and process environment variables, which may be leveraged to access the Kubernetes API Server or Gateway XDS server. Affected versions: - < 1.7.4 - < 1.8.1 We recommend updating to: 1.7.4, 1.8.1. CVSS 9.1 · our assessment: act_now Vendor advisory: https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f Details: https://vuln.today/cve/CVE-2026-53713