Envoy Gateway EUVD-2026-78081

Exploitation requires that Envoy Gateway is deployed in GatewayNamespaceMode (provider.kubernetes.deploy.type=GatewayNamespace) - this is the specific configuration that installs the flawed StreamInterceptor with no UnaryInterceptor. The attacker must have a network position inside the cluster (a pod, per the advisory) with reachability to the xDS gRPC server on TCP port 18000; the CVSS vector AV:A confirms an adjacent, not internet-facing, requirement. The bypass is triggered specifically by using the State-of-the-World xDS protocol (discoveryv3.DiscoveryRequest) rather than Delta, or by calling any unary Fetch RPC. Limiting factors: GatewayNamespaceMode is a non-default deployment choice, exploitation is confined to entities already on the cluster network able to reach port 18000, and impact is read/disclosure only (no config tampering per I:N). Deployments not using GatewayNamespaceMode and versions 1.8.1 / 1.7.4 or later are not exploitable.

The signals are moderately but not uniformly severe. The supplied CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = 7.4) reflects an unauthenticated, low-complexity read against an adjacent (in-cluster) network position, with a scope change because the control plane leaks other workloads' secrets, and confidentiality-only impact (no integrity or availability effect). The AV:A choice is important: this is not internet-reachable by default - the attacker must already hold a foothold as a pod on the cluster network able to reach port 18000, which meaningfully limits blast radius to post-compromise or malicious-tenant scenarios. There is no EPSS score, no SSVC decision, no KEV listing, and no evidence of a public POC in the provided data, so exploitation appears theoretical/targeted rather than opportunistic at this time. The offsetting factor is impact quality: disclosure of TLS private keys and full routing/endpoint configuration is a high-value prize that can enable downstream MITM, impersonation, and lateral movement. Net: a real priority for clusters actually running GatewayNamespaceMode, but the non-default deployment mode and adjacent-only vector keep it below drop-everything urgency.

An attacker who has compromised or legitimately deployed a low-privileged pod in a cluster running Envoy Gateway in GatewayNamespaceMode opens a gRPC connection to the control plane on port 18000 and issues a State-of-the-World StreamSecrets (SDS) request without any JWT. Because the interceptor only validates Delta requests, the SotW request bypasses authentication and streams back TLS private keys and full xDS configuration, which the attacker then uses to impersonate services or intercept traffic. No public POC is identified, but the attack requires only standard gRPC tooling and low complexity.