CVE-2026-53713

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1.

• CWE-20

• https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464
• https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7
• https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead
• https://github.com/envoyproxy/gateway/pull/9171
• https://github.com/envoyproxy/gateway/pull/9172
• https://github.com/envoyproxy/gateway/pull/9173
• https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
• https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
• https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53705A flaw was found in GStreamer's WavPack audio decoder in gst…7.6
• CVE-2026-53706PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstr…8.8
• CVE-2026-53708ContextForge is an AI gateway, registry, and proxy that prov…6.6
• CVE-2026-5371The MonsterInsights – Google Analytics Dashboard for WordPre…7.1
• CVE-2026-53710MCP Context Forge is an AI gateway, registry, and proxy for …10
• CVE-2026-53712SCRAM (Salted Challenge Response Authentication Mechanism) i…8.2
• CVE-2026-53714Envoy Gateway is an open source project for managing Envoy P…7.4
• CVE-2026-53715Envoy Gateway is an open source project for managing Envoy P…5.3
• CVE-2026-53716Envoy Gateway is an open source project for managing Envoy P…6.5
• CVE-2026-53717Envoy Gateway is an open source project for managing Envoy P…6.5
• CVE-2026-53718Envoy Gateway is an open source project for managing Envoy P…6.4
• CVE-2026-53719Envoy Gateway is an open source project for managing Envoy P…6.5