CVE-2026-53713: CWE-20: Improper Input Validation in envoyproxy gateway
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1.
AI Analysis
Technical Summary
Envoy Gateway versions before 1.7.4 and 1.8.1 contain an improper input validation flaw in the to_absolute_normalized_path function within internal/gatewayapi/luavalidator/security.lua. The function fails to normalize redundant path separators before the is_critical_path check, allowing malicious Lua code submitted via EnvoyExtensionPolicy during default Strict validation to access arbitrary files on the gateway controller pod. This can expose sensitive Kubernetes credentials and TLS certificates, potentially compromising Kubernetes API Server and Gateway xDS server security. The vulnerability is resolved in versions 1.7.4 and 1.8.1.
Potential Impact
An attacker with the ability to submit Lua code through EnvoyExtensionPolicy can exploit this vulnerability to read arbitrary files on the gateway controller pod. This includes sensitive files such as Kubernetes service-account tokens and TLS certificates, which can lead to unauthorized access to Kubernetes API Server and Gateway xDS server information. The vulnerability has a CVSS score of 9.1 (critical), indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Envoy Gateway versions 1.7.4 and 1.8.1. Users should upgrade to these or later versions to remediate the issue. There are no vendor advisories indicating that no action is required or that the issue is already mitigated by other means.
CVE-2026-53713: CWE-20: Improper Input Validation in envoyproxy gateway
Description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1.
CVSS v3.1
Score 9.1critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Envoy Gateway versions before 1.7.4 and 1.8.1 contain an improper input validation flaw in the to_absolute_normalized_path function within internal/gatewayapi/luavalidator/security.lua. The function fails to normalize redundant path separators before the is_critical_path check, allowing malicious Lua code submitted via EnvoyExtensionPolicy during default Strict validation to access arbitrary files on the gateway controller pod. This can expose sensitive Kubernetes credentials and TLS certificates, potentially compromising Kubernetes API Server and Gateway xDS server security. The vulnerability is resolved in versions 1.7.4 and 1.8.1.
Potential Impact
An attacker with the ability to submit Lua code through EnvoyExtensionPolicy can exploit this vulnerability to read arbitrary files on the gateway controller pod. This includes sensitive files such as Kubernetes service-account tokens and TLS certificates, which can lead to unauthorized access to Kubernetes API Server and Gateway xDS server information. The vulnerability has a CVSS score of 9.1 (critical), indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Envoy Gateway versions 1.7.4 and 1.8.1. Users should upgrade to these or later versions to remediate the issue. There are no vendor advisories indicating that no action is required or that the issue is already mitigated by other means.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- CLEANSTART-2026-YR40466
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Alpine"]
Threat ID: 6a7f442ebf8831d5396346db
Added to database: 08/14/2026, 16:37:02 UTC
Last enriched: 09/20/2026, 22:15:36 UTC
Last updated: 09/29/2026, 18:11:19 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.