Envoy Gateway Authentication Bypass Leads to Secret Disclosure
A critical vulnerability in Envoy Gateway allows attackers to bypass path validation and access sensitive files on the gateway controller pod.
A critical security vulnerability, identified as CVE-2026-53713, affects Envoy Gateway. The flaw exists in the to_absolute_normalized_path function, which fails to correctly collapse redundant path separators. Because the security validation logic does not account for double-slash variants, attackers can bypass critical path checks to read arbitrary files from the gateway controller pod's filesystem.
This vulnerability, rated with a CVSS score of 9.1, permits the unauthorized retrieval of sensitive data including Kubernetes service account tokens, TLS certificates, and process environment variables. These credentials can subsequently be leveraged to access the Kubernetes API Server or the Gateway XDS server.
Users are urged to update to patched versions v1.7.4 or v1.8.1 to mitigate this risk. The fix ensures that redundant path separators are properly normalized and that directory traversal attempts are rejected. Additional risk reduction measures can be found in the official Lua documentation for Envoy Gateway.
Sources
- GitHub Security Advisories Original source
Continue Reading
SecurityFulcrumSec Claims Manchester Airport Breach, 86 GB Stolen
Extortion group FulcrumSec says it stole 86 GB from Manchester Airports Group, exposing detailed travel data.
SecurityAnthropic tackles Claude session hijacking via infostealers
Anthropic warns that infostealer malware is stealing Claude login sessions to drain accounts.
SecurityAI agents can be tricked into installing malware via unclaimed code packages
Researchers found 120 unregistered domains in AI documentation that could be hijacked to infect corporate networks.