Envoy Gateway CVE-2026-53714
HIGH
GHSA-22xc-xg2r-9j7v
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Any in-cluster pod reaching port 18000 exploits it unauthenticated with low complexity (AV:A/AC:L/PR:N); leaking other workloads' TLS keys is a scope change (S:C) with confidentiality-only impact (C:H, I:N, A:N).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
When Envoy Gateway runs in GatewayNamespaceMode (provider.kubernetes.deploy.type=GatewayNamespace), the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary (Fetch) RPC methods for all registered discovery services. Since there is no unary interceptor, these Fetch endpoints are completely unauthenticated.
Additionally, the JWT authentication interceptor in GatewayNamespaceMode only validates tokens when the received gRPC message is of type discoveryv3.DeltaDiscoveryRequest . If the message is a discoveryv3.DiscoveryRequest - used by the State-of-the-World (SotW) xDS protocol - the type assertion fails, the validation block is skipped entirely, and RecvMsg returns nil (success) without any authentication.
Any pod in the cluster that can reach the xDS server (port 18000) can use the SotW protocol to bypass JWT authentication and access:
- TLS private keys via StreamSecrets (SDS)
- All xDS resources via StreamAggregatedResources (ADS)
- Backend endpoints via StreamClusters / StreamEndpoints (CDS/EDS)
- Routing rules via StreamRoutes / StreamListeners (RDS/LDS)
Credits
Envoy Gateway thanks @dashingDragon and @Donjon-Cerberus for reporting this issue.
Articles & Coverage 1
AnalysisAI
Authentication bypass and control-plane information disclosure in Envoy Gateway (versions >= 1.8.0-rc.0 to < 1.8.1, and all releases < 1.7.4) allows any in-cluster pod that can reach the xDS gRPC server on port 18000 to read sensitive xDS resources without valid credentials. The flaw affects only deployments running in GatewayNamespaceMode, where the JWT StreamInterceptor mishandles State-of-the-World DiscoveryRequests and no UnaryInterceptor guards the Fetch endpoints, exposing TLS private keys (SDS), clusters/endpoints, and routing configuration. No public exploit identified at time of analysis, and it is not listed in CISA KEV; CVSS is 7.4 (High).
Technical ContextAI
Envoy Gateway is a Kubernetes-native control plane that manages Envoy proxies via the xDS protocol, built on the go-control-plane library. The go-control-plane server exposes each discovery service (ADS, SDS, CDS, EDS, RDS, LDS) over both streaming RPCs and unary Fetch RPCs. In GatewayNamespaceMode the gRPC server registers a StreamInterceptor to enforce JWT authentication but registers no UnaryInterceptor, so the unary Fetch methods are left entirely unguarded. Compounding this, the StreamInterceptor's validation logic only runs when the inbound message type-asserts to discoveryv3.DeltaDiscoveryRequest (the incremental/Delta xDS protocol); a discoveryv3.DiscoveryRequest from the legacy State-of-the-World (SotW) protocol fails the assertion, skips the validation branch, and RecvMsg returns nil, treating the unauthenticated request as valid. This is a textbook CWE-306 (Missing Authentication for a Critical Function): the security control exists but does not cover all code paths and message types. Affected package is the Go module github.com/envoyproxy/gateway.
RemediationAI
Vendor-released patch: upgrade to Envoy Gateway 1.8.1 (for the 1.8.x line) or 1.7.4 (for the 1.7.x line), which add the missing unary authentication and correctly validate SotW DiscoveryRequest messages. If immediate upgrade is not possible, the most direct compensating control is to stop running in GatewayNamespaceMode where feasible, or restrict network reachability to the xDS server: apply a Kubernetes NetworkPolicy that allows ingress to the control plane's port 18000 only from the specific managed Envoy proxy pods (by namespace/pod selector), denying all other in-cluster pods - the trade-off is that an overly tight or misconfigured policy can break proxy config delivery, so validate proxy connectivity after applying. Additionally minimize the impact of key exposure by rotating any TLS material that may have been reachable and enforcing per-namespace tenant isolation. Refer to the advisory at https://github.com/envoyproxy/gateway/security/advisories/GHSA-22xc-xg2r-9j7v for authoritative guidance.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today