CVE-2026-53714High· 7.4▾ TwilightEnvoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deplo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC unauthenticated. The streaming interceptor also authenticates only discoveryv3.DeltaDiscoveryRequest messages; a discoveryv3.DiscoveryRequest used by the State-of-the-World protocol fails the type assertion and returns success without JWT validation. Any pod that can reach port 18000 can use the unauthenticated unary or State-of-the-World paths to retrieve TLS private keys through StreamSecrets, all xDS resources through StreamAggregatedResources, backend endpoints through StreamClusters or StreamEndpoints, and routing configuration through StreamRoutes or StreamListeners. This issue is fixed in versions 1.7.4 and 1.8.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/envoyproxy/gateway >= 1.8.0-rc.0, < 1.8.1github.com/envoyproxy/gateway < 1.7.4Patched in:
github.com/envoyproxy/gateway 1.8.1github.com/envoyproxy/gateway 1.7.4Source: https://osv.dev/vulnerability/GHSA-22xc-xg2r-9j7v
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53718Medium· 6.4Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
CVE-2026-53716Medium· 6.5Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
CVE-2026-53719Medium· 6.5Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
CVE-2026-53717Medium· 6.5Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
CVE-2026-53715Medium· 5.3Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
CVE-2026-53713Critical· 9.1Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway