CVE-2026-53718
Fixed in a distro release EPSS <1%CVSS 6.4
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.
Products: envoyproxy gateway
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/envoyproxy/gateway | 1.8.1 |
| Go | github.com/envoyproxy/gateway | 1.7.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | datadog-agent-7.76 | 7.76.3-r41 |
| Chainguard | datadog-cluster-agent-7.73 | 7.73.3-r23 |
| Chainguard | datadog-cluster-agent-7.74 | 7.74.1-r24 |
| Chainguard | datadog-cluster-agent-7.75 | no fix |
| Chainguard | datadog-cluster-agent-7.76 | 7.76.3-r32 |
| Chainguard | datadog-cluster-agent-7.77 | 7.77.3-r23 |
| Chainguard | datadog-cluster-agent-7.78 | 7.78.4-r16 |
| Chainguard | datadog-cluster-agent-7.79 | 7.79.2-r15 |
| Chainguard | datadog-cluster-agent-7.80 | 7.80.4-r7 |
| Chainguard | datadog-cluster-agent-fips-7.73 | 7.73.3-r26 |
| Chainguard | datadog-cluster-agent-fips-7.74 | 7.74.1-r26 |
| Chainguard | datadog-cluster-agent-fips-7.75 | no fix |
| Chainguard | datadog-cluster-agent-fips-7.76 | 7.76.3-r32 |
| Chainguard | datadog-cluster-agent-fips-7.77 | 7.77.3-r29 |
| Chainguard | datadog-cluster-agent-fips-7.78 | 7.78.4-r14 |
| Chainguard | datadog-cluster-agent-fips-7.79 | 7.79.2-r8 |
| Chainguard | datadog-cluster-agent-fips-7.80 | 7.80.4-r5 |
| Chainguard | envoy-gateway-1.5 | no fix |
| Chainguard | envoy-gateway-1.5-egctl | no fix |
| Chainguard | envoy-gateway-1.6 | no fix |
| Chainguard | envoy-gateway-1.6-egctl | no fix |
| Chainguard | envoy-gateway-fips-1.5 | no fix |
| Chainguard | envoy-gateway-fips-1.5-egctl | no fix |
| Chainguard | envoy-gateway-fips-1.6 | no fix |
| Chainguard | envoy-gateway-fips-1.6-egctl | no fix |
| Chainguard | gitlab-operator | 3.1.2-r1 |
| Chainguard | gitlab-operator-fips | 3.2.0-r0 |
| Chainguard | tigera-operator-1.37 | no fix |
| Chainguard | tigera-operator-1.38 | 0 |
| Chainguard | tigera-operator-1.40 | 1.40.13-r4 |
| Chainguard | tigera-operator-1.41 | 0 |
| Chainguard | tigera-operator-1.42 | 1.42.4-r2 |
| Chainguard | tigera-operator-fips-1.37 | no fix |
| Chainguard | tigera-operator-fips-1.38 | 0 |
| Chainguard | tigera-operator-fips-1.40 | 1.40.13-r5 |
| Chainguard | tigera-operator-fips-1.41 | 0 |
| Chainguard | tigera-operator-fips-1.42 | 1.42.4-r4 |
| Wolfi | datadog-agent-7.76 | 7.76.3-r41 |
| Wolfi | datadog-cluster-agent-7.73 | 7.73.3-r23 |
| Wolfi | datadog-cluster-agent-7.75 | no fix |
| Wolfi | datadog-cluster-agent-7.76 | 7.76.3-r32 |
| Wolfi | datadog-cluster-agent-7.77 | 7.77.3-r23 |
| Wolfi | datadog-cluster-agent-7.78 | 7.78.4-r16 |
| Wolfi | datadog-cluster-agent-7.79 | 7.79.2-r15 |
| Wolfi | datadog-cluster-agent-7.80 | 7.80.4-r7 |
| Wolfi | tigera-operator-1.40 | 1.40.13-r4 |
| Wolfi | tigera-operator-1.41 | 0 |
| Wolfi | tigera-operator-1.42 | 1.42.4-r2 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |