CVE-2026-53714

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53714
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53714.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53714
Aliases
Downstream
Related
Published
2026-09-14T20:17:22Z
Modified
2026-09-16T03:46:26Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
Details

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC unauthenticated. The streaming interceptor also authenticates only discoveryv3.DeltaDiscoveryRequest messages; a discoveryv3.DiscoveryRequest used by the State-of-the-World protocol fails the type assertion and returns success without JWT validation. Any pod that can reach port 18000 can use the unauthenticated unary or State-of-the-World paths to retrieve TLS private keys through StreamSecrets, all xDS resources through StreamAggregatedResources, backend endpoints through StreamClusters or StreamEndpoints, and routing configuration through StreamRoutes or StreamListeners. This issue is fixed in versions 1.7.4 and 1.8.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53714.json"
}
References

Affected packages

Git / github.com/envoyproxy/gateway

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/gateway
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
2de2611fdbbca83d4a1ede99417c90fcdead24d9
Fixed
062b176235b72d339fac340d23dd37679b36dca6
Fixed
097ab899b9d041452d02f15d738514eda10ea21b
Fixed
4df0809ff1ed59ffb09604da4084335b8c6647c5
Fixed
e9124abc4ff4b63a218a6890c1b28a982c850465
Fixed
f1f9829af2a231f0cae915c09800353c76622d97
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.4"
        },
        {
            "introduced": "1.8.0-rc.0"
        },
        {
            "fixed": "1.8.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
latest
v0.*
v0.1.0
v0.2.0
v0.2.0-rc1
v0.2.0-rc2
v0.5.0-rc.1
v1.*
v1.6.0-rc.0
v1.7.0
v1.7.0-rc.0
v1.7.0-rc.1
v1.7.0-rc.2
v1.7.1
v1.7.2
v1.7.3
v1.8.0
v1.8.0-rc.0
v1.8.0-rc.1
v1.9.0-rc.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53714.json"