Authentication bypass in Envoy Gateway (CVE-2026-53714)

Envoy Gateway in GatewayNamespaceMode fails to authenticate xDS gRPC unary (Fetch) endpoints due to a missing UnaryInterceptor, and additionally skips JWT validation for State-of-the-World (SotW) DiscoveryRequest messages in its StreamInterceptor. Any pod with network access to the xDS server on port 18000 can exploit these flaws to retrieve TLS private keys, routing rules, backend endpoints, and all xDS resources without authentication. Affected versions: - < 1.7.4 - < 1.8.1 We recommend updating to: 1.7.4, 1.8.1. CVSS 7.4 · our assessment: this_week Vendor advisory: https://github.com/envoyproxy/gateway/security/advisories/GHSA-22xc-xg2r-9j7v Details: https://vuln.today/cve/CVE-2026-53714