GitHub Advisoryadvisory · Go

GHSA-m2v6-2jmh-4c68 Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

MEDIUM Published 2026-07-16 Modified 2026-07-16 Official page ↗
Aliases
CVE-2026-53719
Ecosystem
Go
Packages
github.com/envoyproxy/gateway
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-476
Reviewed
2026-07-16

Affected packages

• Go github.com/envoyproxy/gateway: >= 1.8.0-rc.0, < 1.8.1 → fixed in 1.8.1 • Go github.com/envoyproxy/gateway: < 1.7.4 → fixed in 1.7.4

Description

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions (4): • Tenant has SecurityPolicy + TCPRoute RBAC (baseline) • Tenant namespace permitted to attach TCPRoute to a Gateway listener • spec.authorization omitted (the trigger) • No admission webhook blocks the shape Description: A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but unwinds the entire handle() callback in runner/runner.go:192, so xDS/Infra IR publishing stalls controller-wide until an admin deletes the object. Data plane keeps serving last-good config.

Related

Alias · CVE (1)

  • CVE-2026-53719 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. vulnerability

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References