What is the CVSS score of CVE-2026-53715?

CVE-2026-53715 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-53715?

Yes, a patch is available for CVE-2026-53715. Update the affected software to the latest version immediately.

Envoy Gateway CVE-2026-53715

MEDIUM

Race Condition (CWE-362)

2026-07-16 https://github.com/envoyproxy/gateway

GHSA-8fv2-88gg-hm7q

Information Disclosure Race Condition Kubernetes

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.3 MEDIUM

Network reader on :18002, race condition raises AC:H, tenant RBAC for EnvoyExtensionPolicy sets PR:L, DoS-only impact with no confidentiality or integrity consequence.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 19:52 vuln.today

Analysis Generated

Jul 16, 2026 - 19:52 vuln.today

DescriptionGitHub Advisory

Vulnerability report without repro case. Repro case may be added later after harness is complete.

Preconditions (4):

Pod-network reachability to :18002 (no auth)
Tenant can create EnvoyExtensionPolicy (baseline)
Attacker pod floods GET while churning EnvoyExtensionPolicy with distinct Wasm URLs
Read at :153 must overlap a write at :201/:209 (probabilistic, attacker controls both rates)

Description:

httpserver.go:153 reads s.mappingPath2Cache with no lock while httpserver.go:201/209 write it under s.Lock(); the struct uses a plain map. Writer is tenant-reachable via EnvoyExtensionPolicy translation, reader is pod-network-reachable on :18002 with per-request goroutines. Go's concurrent map read+write detection calls runtime.throw, which net/http's per-conn recover cannot catch, so the controller process exits - cross-tenant control-plane DoS. Capped at MEDIUM: DoS-only, k8s restarts pod, timing-dependent trigger.

AnalysisAI

Envoy Gateway's Wasm extension cache HTTP server (port 18002) can be crashed by a tenant-level attacker, causing a cross-tenant control-plane denial of service. The race condition in httpserver.go causes Go's runtime to call runtime.throw upon detecting an unsynchronized concurrent map access - a fatal signal that net/http's per-connection recover cannot intercept - terminating the entire controller process. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain EnvoyExtensionPolicy RBAC permission

Delivery

Gain pod-network access to controller :18002

Exploit

Flood GET requests to Wasm cache endpoint

Install

Simultaneously churn EnvoyExtensionPolicy with distinct Wasm URLs

Race read goroutine against write goroutine on plain map

Execute

Go runtime.throw terminates controller process

Impact

Control-plane DoS affects all tenants

Recon

Obtain EnvoyExtensionPolicy RBAC permission

Delivery

Gain pod-network access to controller :18002

Exploit

Flood GET requests to Wasm cache endpoint

Install

Simultaneously churn EnvoyExtensionPolicy with distinct Wasm URLs

Race read goroutine against write goroutine on plain map

Execute

Go runtime.throw terminates controller process

Impact

Control-plane DoS affects all tenants

Vulnerability AssessmentAI

Exploitation	Four specific preconditions must all be satisfied. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.3) is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker operating a pod within a multi-tenant Kubernetes cluster with permission to create EnvoyExtensionPolicy resources simultaneously floods GET requests to the controller's pod-network address on port 18002 (the Wasm cache server) and rapidly creates and updates EnvoyExtensionPolicy objects referencing distinct Wasm URLs. The flood saturates the read goroutine pool while policy churning keeps write goroutines active; when a read and write goroutine access s.mappingPath2Cache concurrently, Go's runtime detects the unsynchronized map access, calls runtime.throw, and terminates the Envoy Gateway controller process, disrupting control-plane operations for all tenants until Kubernetes restarts the pod.
Remediation	Upgrade to Envoy Gateway 1.7.4 (for 1.7.x deployments) or 1.8.1 (for 1.8.x deployments), as confirmed by the vendor advisory GHSA-8fv2-88gg-hm7q at https://github.com/envoyproxy/gateway/security/advisories/GHSA-8fv2-88gg-hm7q. … Detailed patch versions, workarounds, and compensating controls in full report.