GHSA-22xc-xg2r-9j7v

Suggest an improvement
Source
https://github.com/advisories/GHSA-22xc-xg2r-9j7v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-22xc-xg2r-9j7v/GHSA-22xc-xg2r-9j7v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-22xc-xg2r-9j7v
Aliases
Downstream
CGA (72)
MINI (6)
Published
2026-07-16T19:32:23Z
Modified
2026-09-21T09:40:34Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode
Details

Impact

When Envoy Gateway runs in GatewayNamespaceMode (provider.kubernetes.deploy.type=GatewayNamespace), the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary (Fetch) RPC methods for all registered discovery services. Since there is no unary interceptor, these Fetch endpoints are completely unauthenticated.

Additionally, the JWT authentication interceptor in GatewayNamespaceMode only validates tokens when the received gRPC message is of type discoveryv3.DeltaDiscoveryRequest . If the message is a discoveryv3.DiscoveryRequest — used by the State-of-the-World (SotW) xDS protocol — the type assertion fails, the validation block is skipped entirely, and RecvMsg returns nil (success) without any authentication.

Any pod in the cluster that can reach the xDS server (port 18000) can use the SotW protocol to bypass JWT authentication and access:

  • TLS private keys via StreamSecrets (SDS)
  • All xDS resources via StreamAggregatedResources (ADS)
  • Backend endpoints via StreamClusters / StreamEndpoints (CDS/EDS)
  • Routing rules via StreamRoutes / StreamListeners (RDS/LDS)

Credits

Envoy Gateway thanks @dashingDragon and @Donjon-Cerberus for reporting this issue.

Database specific 
{
    "cwe_ids":  [
        "CWE-306"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-16T19:32:23Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Go / github.com/envoyproxy/gateway

Package

Name
github.com/envoyproxy/gateway
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/gateway

Affected ranges

Type
SEMVER
Events
Introduced
1.8.0-rc.0
Fixed
1.8.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-22xc-xg2r-9j7v/GHSA-22xc-xg2r-9j7v.json"

Go / github.com/envoyproxy/gateway

Package

Name
github.com/envoyproxy/gateway
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/gateway

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.7.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-22xc-xg2r-9j7v/GHSA-22xc-xg2r-9j7v.json"