CVE-2026-53719

Summary

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

Severity

medium

CVSS

6.5

EPSS

0.7% (p53)

CWE

CWE-476

Also known as

GHSA-m2v6-2jmh-4c68

Published

2026-07-16

Updated

2026-07-16

Advisory details

Vulnerability report without repro case. Repro case may be added later after harness is complete.

Preconditions (4):

• Tenant has SecurityPolicy + TCPRoute RBAC (baseline)
• Tenant namespace permitted to attach TCPRoute to a Gateway listener
• spec.authorization omitted (the trigger)
• No admission webhook blocks the shape

Description:

A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but unwinds the entire handle() callback in runner/runner.go:192, so xDS/Infra IR publishing stalls controller-wide until an admin deletes the object. Data plane keeps serving last-good config.

References

• https://github.com/advisories/GHSA-m2v6-2jmh-4c68
• https://github.com/envoyproxy/gateway/security/advisories/GHSA-m2v6-2jmh-4c68

Related advisories

• CVE-2026-53713 — critical · Go/github.com/envoyproxy/gateway
• CVE-2026-53714 — high · Go/github.com/envoyproxy/gateway
• CVE-2026-53715 — medium · Go/github.com/envoyproxy/gateway
• CVE-2026-53717 — medium · Go/github.com/envoyproxy/gateway
• CVE-2026-53716 — medium · Go/github.com/envoyproxy/gateway
• CVE-2026-53718 — medium · Go/github.com/envoyproxy/gateway
• CVE-2026-22771 — medium · Go/github.com/envoyproxy/gateway
• CVE-2026-55209 — critical · PyPI/resdata

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity