Vulnerability in Envoy Gateway's Lua Validator Allows Unauthorized File Access

CVE-2026-53713

What is CVE-2026-53713?

The Envoy Gateway is an open source project designed to manage the Envoy Proxy as either a standalone or Kubernetes-based application gateway. Prior to versions 1.7.4 and 1.8.1, a flaw existed in the to_absolute_normalized_path function found in internal/gatewayapi/luavalidator/security.lua. This flaw allowed for the improper validation of Lua code submitted via EnvoyExtensionPolicy, failing to collapse redundant path separators. Unlike Linux, which resolves double-slash paths to a single slash, the validator's inability to detect these variations permitted attackers to exploit this path issue. Consequently, this limitation allowed unauthorized access to arbitrary files from the gateway controller pod, including sensitive Kubernetes service-account tokens, TLS certificates, and environment data. The exposure of these credentials could lead to critical information disclosure concerning the Kubernetes API Server or Gateway xDS server. The issue has since been rectified in versions 1.7.4 and 1.8.1.

References