Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 2 total.
Library:
github.com/envoyproxy/gateway
CVE-2026-53714
HIGH
CVSS 7.4
Verified Advisory
Jul 16, 2026
Authentication bypass in Envoy Gateway (CVE-2026-53714)
Envoy Gateway in GatewayNamespaceMode fails to authenticate xDS gRPC unary (Fetch) endpoints due to a missing UnaryInterceptor, and additionally skips JWT validation for State-of-the-World (SotW) DiscoveryRequest mess...
Fixed in 1.7.4; 1.8.1
Authentication Bypass
Kubernetes
CVE-2026-53713
CRITICAL
CVSS 9.1
Verified Advisory
Jul 16, 2026
Path traversal in Envoy Gateway via double-slash bypass (CVE-2026-53713)
CVE-2026-53713 is a critical improper input validation vulnerability in Envoy Gateway's `to_absolute_normalized_path` function (security.lua:28-43) that fails to collapse redundant path separators (`//` to `/`). This ...
Fixed in 1.7.4; 1.8.1
RCE
Kubernetes