Envoy Gateway CVE-2026-53719
MEDIUM
GHSA-m2v6-2jmh-4c68
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Kubernetes API access is network-reachable (AV:N); tenant RBAC is required (PR:L); impact is pure persistent availability loss with no confidentiality or integrity consequence (C:N/I:N/A:H).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Vulnerability report without repro case. Repro case may be added later after harness is complete.
Preconditions (4):
- Tenant has SecurityPolicy + TCPRoute RBAC (baseline)
- Tenant namespace permitted to attach TCPRoute to a Gateway listener
- spec.authorization omitted (the trigger)
- No admission webhook blocks the shape
Description:
A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but unwinds the entire handle() callback in runner/runner.go:192, so xDS/Infra IR publishing stalls controller-wide until an admin deletes the object. Data plane keeps serving last-good config.
AnalysisAI
Deterministic nil-pointer dereference in Envoy Gateway's gatewayapi runner allows a low-privileged tenant to permanently stall controller-wide xDS and Infrastructure IR publishing by submitting a single malformed CRD. Any tenant with namespace-scoped RBAC permission to create SecurityPolicy and TCPRoute resources can trigger a panic on every reconcile cycle by omitting the spec.authorization field, requiring administrator intervention to restore control-plane operations. No exploitation confirmed in the wild (not in CISA KEV); patches are available in versions 1.7.4 and 1.8.1.
Technical ContextAI
Envoy Gateway is a Kubernetes-native control plane that implements the Gateway API specification on top of the Envoy proxy, managing xDS configuration and Infrastructure IR publishing. The affected component is the gatewayapi runner (runner/runner.go:192), which reconciles Gateway API custom resources including SecurityPolicy and TCPRoute CRDs. CWE-476 (NULL Pointer Dereference) is the root cause: when a SecurityPolicy targets a TCPRoute and spec.authorization is absent rather than explicitly set, the reconciler dereferences a nil pointer. The recover() call in message/watchutil.go:53 catches the resulting panic and keeps the process alive, but unwinds the entire handle() callback, halting xDS and Infra IR publishing for all tenants controller-wide until the offending object is deleted. Affected packages are pkg:go/github.com/envoyproxy/gateway versions prior to 1.7.4 and 1.8.0-rc.0 through pre-1.8.1.
RemediationAI
Upgrade Envoy Gateway to version 1.7.4 (for 1.7.x deployments) or 1.8.1 (for 1.8.x deployments) as confirmed by GitHub Security Advisory GHSA-m2v6-2jmh-4c68 at https://github.com/envoyproxy/gateway/security/advisories/GHSA-m2v6-2jmh-4c68. If an immediate upgrade is not feasible, the most effective compensating control is to audit and restrict tenant RBAC so that untrusted namespaces cannot create SecurityPolicy resources or attach TCPRoutes to Gateway listeners - this removes all four preconditions at once, though it may limit intended multi-tenant delegation use cases. A second compensating control is to deploy an admission webhook (e.g., OPA/Gatekeeper or Kyverno) that rejects SecurityPolicy objects targeting TCPRoutes where spec.authorization is absent; this blocks the malformed shape before it reaches the reconciler, with the trade-off that webhook authoring requires care to avoid rejecting legitimately shaped policies.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today