CVE-2026-53718

MEDIUM 6.4

Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

CVSS Score

6.4

EPSS Score

0.0%

EPSS Percentile

0th

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.

CWE	CWE-862
Vendor	envoyproxy
Product	gateway
Published	Sep 14, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for envoyproxy gateway

Be the first to know when new medium vulnerabilities affecting envoyproxy gateway are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Affected Versions

envoyproxy / gateway

< 1.7.4 >= 1.8.0-rc.0, < 1.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗