CVE-2026-53718

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.

• CWE-862

• https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464
• https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7
• https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead
• https://github.com/envoyproxy/gateway/pull/9171
• https://github.com/envoyproxy/gateway/pull/9172
• https://github.com/envoyproxy/gateway/pull/9173
• https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
• https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
• https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7

Published

Sep 14, 2026

Last Modified

Sep 15, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53712SCRAM (Salted Challenge Response Authentication Mechanism) i…8.2
• CVE-2026-53713Envoy Gateway is an open source project for managing Envoy P…9.1
• CVE-2026-53714Envoy Gateway is an open source project for managing Envoy P…7.4
• CVE-2026-53715Envoy Gateway is an open source project for managing Envoy P…5.3
• CVE-2026-53716Envoy Gateway is an open source project for managing Envoy P…6.5
• CVE-2026-53717Envoy Gateway is an open source project for managing Envoy P…6.5
• CVE-2026-53719Envoy Gateway is an open source project for managing Envoy P…6.5
• CVE-2026-5372An issue that allowed a SQL injection attack vector related …6.4
• CVE-2026-53720pymonocypher uses cython to wrap the Monocypher C library. P…5.1
• CVE-2026-53721Nuxt is an open-source web development framework for Vue.js.…8.2
• CVE-2026-53722Nuxt is an open-source web development framework for Vue.js.…5.4
• CVE-2026-53723Guzzle Services provides an implementation of the Guzzle Com…5.8