CVE-2026-53718 Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
Attackers can bypass cross-namespace authorization checks in Envoy Gateway to access backend resources in other namespaces without permission.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53718?
CVE-2026-53718 is a medium-severity missing authorization vulnerability in envoyproxy gateway, published on 14 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.
Weakness: CWE-862
Which versions are affected by CVE-2026-53718?
6 open source packages ship an affected version, including github.com/envoyproxy/gateway and envoy-gateway.
| Package | Affected | Fixed in |
|---|---|---|
github.com/envoyproxy/gateway Go | All versions | 1.7.4, 1.8.1 |
github.com/envoyproxy/gateway Go | All versions | 1.7.4 |
github.com/envoyproxy/gateway Go | All versions | 1.7.4 |
github.com/envoyproxy/gateway Go | From 1.8.0-rc.0 | 1.8.1 |
github.com/envoyproxy/gateway Go | From 1.8.0-rc.0 | 1.8.1 |
envoy-gateway Bitnami | All versions | 1.7.4, 1.8.1 |
How do I fix CVE-2026-53718?
Upgrade github.com/envoyproxy/gateway to a fixed version for your release line: 1.7.4 or 1.8.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-53718 being exploited?
There is no known exploitation of CVE-2026-53718 in the wild and no public exploit code.
Sources
Also known as BIT-envoy-gateway-2026-53718, CLEANSTART-2026-NI49374, CLEANSTART-2026-XJ72729, GHSA-fcrp-7gc2-93g7, GO-2026-6007, MINI-59pv-636w-8696 and 3 more.