Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-53713

critical

CVE-2026-53713

github.com/envoyproxy/gateway: Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Published Modified CWE 20
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

GHSA9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Trivy's own label is CRITICAL. Rated critical by GHSA, Red Hat, Bitnami.

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1.

Affected packages and fixed versions

SourcePackageFixed in
bitnami::Bitnami Vulnerability Databaseenvoy-gateway1.7.4, 1.8.1
go::GitHub Security Advisory Gogithub.com/envoyproxy/gateway1.8.1, 1.7.4
chainguarddatadog-agent-7.73, datadog-agent-7.74, datadog-agent-7.76 and 17 more7.73.3-r23 and 19 more
minimosdatadog-agent-7, datadog-agent-fips-7, tigera-operator-1.40 and 3 more7.81.1-r1 and 2 more
wolfidatadog-agent-7.73, datadog-agent-7.76, datadog-agent-7.77 and 4 more7.73.3-r23 and 6 more
Show all 35 entries from 5 sources
SourcePackageFixed in
bitnami::Bitnami Vulnerability Databaseenvoy-gateway1.7.4, 1.8.1
go::GitHub Security Advisory Gogithub.com/envoyproxy/gateway1.8.1, 1.7.4
chainguarddatadog-agent-7.737.73.3-r23
chainguarddatadog-agent-7.747.74.1-r24
chainguarddatadog-agent-7.767.76.3-r41
chainguarddatadog-agent-7.777.77.3-r23
chainguarddatadog-agent-7.787.78.4-r16
chainguarddatadog-agent-7.797.79.2-r15
chainguarddatadog-agent-7.807.80.4-r7
chainguarddatadog-agent-fips-7.737.73.3-r26
chainguarddatadog-agent-fips-7.747.74.1-r26
chainguarddatadog-agent-fips-7.767.76.3-r32
chainguarddatadog-agent-fips-7.777.77.3-r29
chainguarddatadog-agent-fips-7.787.78.4-r14
chainguarddatadog-agent-fips-7.797.79.2-r8
chainguarddatadog-agent-fips-7.807.80.4-r5
chainguardgitlab-operator3.1.2-r1
chainguardgitlab-operator-fips3.2.0-r0
chainguardtigera-operator-1.401.40.13-r4
chainguardtigera-operator-1.421.42.4-r2
chainguardtigera-operator-fips-1.401.40.13-r5
chainguardtigera-operator-fips-1.421.42.4-r4
minimosdatadog-agent-77.81.1-r1
minimosdatadog-agent-fips-77.81.1-r1
minimostigera-operator-1.401.40.14-r0
minimostigera-operator-1.421.42.4-r2
minimostigera-operator-fips-1.401.40.14-r0
minimostigera-operator-fips-1.421.42.4-r2
wolfidatadog-agent-7.737.73.3-r23
wolfidatadog-agent-7.767.76.3-r41
wolfidatadog-agent-7.777.77.3-r23
wolfidatadog-agent-7.787.78.4-r16
wolfidatadog-agent-7.797.79.2-r15
wolfidatadog-agent-7.807.80.4-r7
wolfitigera-operator-1.421.42.4-r2

References

All 13 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.