Unauthenticated Access in Envoy Gateway for Kubernetes Deployments

CVE-2026-53714

What is CVE-2026-53714?

Envoy Gateway, an open source project that manages the Envoy Proxy as a standalone or Kubernetes-based application gateway, contains a critical flaw in its xDS gRPC server when operating in GatewayNamespaceMode. Prior to versions 1.7.4 and 1.8.1, it improperly configures JWT authentication, allowing unauthenticated access to several critical functionalities. This includes unverified fetch RPCs that can exploit paths to retrieve sensitive data, such as TLS private keys and routing configurations. Any pod with access to port 18000 can exploit this vulnerability, enabling unauthorized access to StreamSecrets, StreamAggregatedResources, and other sensitive xDS resources.

References