CVE-2026-53714

描述

### Impact When Envoy Gateway runs in GatewayNamespaceMode (`provider.kubernetes.deploy.type=GatewayNamespace`), the xDS gRPC server is configured with a `StreamInterceptor` for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary (Fetch) RPC methods for all registered discovery services. Since there is no unary interceptor, these Fetch endpoints are completely unauthenticated. Additionally, the JWT authentication interceptor in GatewayNamespaceMode only validates tokens when the received gRPC message is of type `discoveryv3.DeltaDiscoveryRequest` . If the message is a `discoveryv3.DiscoveryRequest` — used by the State-of-the-World (SotW) xDS protocol — the type assertion fails, the validation block is skipped entirely, and RecvMsg returns nil (success) without any authentication. Any pod in the cluster that can reach the xDS server (port 18000) can use the SotW protocol to bypass JWT authentication and access: * TLS private keys via StreamSecrets (SDS) * All xDS resources via StreamAggregatedResources (ADS) * Backend endpoints via StreamClusters / StreamEndpoints (CDS/EDS) * Routing rules via StreamRoutes / StreamListeners (RDS/LDS) ### Credits Envoy Gateway thanks @dashingDragon and @Donjon-Cerberus for reporting this issue.

如何修補 CVE-2026-53714

要修補 CVE-2026-53714,請將受影響套件升級到下列已修補版本。

• —升級至 1.8.1 或更新版本
• —升級至 1.7.4 或更新版本

CVE-2026-53714 正在被利用嗎?

目前沒有被利用訊號。CVE-2026-53714 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(2)

• >= 1.8.0-rc.0, < 1.8.1
• from 0, < 1.7.4, >= 1.8.0-rc.0, < 1.8.1

CVSS 分數

參考連結(2)

• PATCHgithub.com/envoyproxy/gateway
• WEBgithub.com/envoyproxy/gateway/security/advisories/GHSA-22xc-xg2r-9j7v