CVE-2026-53718

The record

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.

Affected packages

Related vulnerabilities

• CVE-2026-65959 Vitess is a database clustering system for horizontal scaling of MySQL. CWE-862
• CVE-2026-73653 Vitest is a testing framework powered by Vite. CWE-862
• CVE-2026-6470 Missing authorization in PostgreSQL DDL commands allows an object creator to achieve… CWE-862
• CVE-2026-6471 Missing authorization in PostgreSQL logical decoding allows a non-superuser holding… CWE-862
• CVE-2026-15060 When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows… CWE-862
• CVE-2026-52870 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-862
• CVE-2026-54695 Pipecat is an open-source Python framework for building real-time voice and multimodal… CWE-862
• CVE-2026-55628 In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks… CWE-862