CVE-2026-53719

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization. The persistent object triggers the panic on every reconcile; recovery in message/watchutil.go keeps the process alive but unwinds the runner/runner.go handle callback, stalling controller-wide xDS and infrastructure intermediate-representation publishing until an administrator deletes the object. The data plane continues to serve the last known good configuration while publication is stalled. This issue is fixed in versions 1.7.4 and 1.8.1.

• CWE-476

• https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464
• https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7
• https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead
• https://github.com/envoyproxy/gateway/pull/9171
• https://github.com/envoyproxy/gateway/pull/9172
• https://github.com/envoyproxy/gateway/pull/9173
• https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
• https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
• https://github.com/envoyproxy/gateway/security/advisories/GHSA-m2v6-2jmh-4c68

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53713Envoy Gateway is an open source project for managing Envoy P…9.1
• CVE-2026-53714Envoy Gateway is an open source project for managing Envoy P…7.4
• CVE-2026-53715Envoy Gateway is an open source project for managing Envoy P…5.3
• CVE-2026-53716Envoy Gateway is an open source project for managing Envoy P…6.5
• CVE-2026-53717Envoy Gateway is an open source project for managing Envoy P…6.5
• CVE-2026-53718Envoy Gateway is an open source project for managing Envoy P…6.4
• CVE-2026-5372An issue that allowed a SQL injection attack vector related …6.4
• CVE-2026-53720pymonocypher uses cython to wrap the Monocypher C library. P…5.1
• CVE-2026-53721Nuxt is an open-source web development framework for Vue.js.…8.2
• CVE-2026-53722Nuxt is an open-source web development framework for Vue.js.…5.4
• CVE-2026-53723Guzzle Services provides an implementation of the Guzzle Com…5.8
• CVE-2026-53724Parse Server is an open source backend that can be deployed …2.1