{"id":"CVE-2026-53713","aliases":["BIT-envoy-gateway-2026-53713","GHSA-wcrf-9vrr-854f","GO-2026-6011"],"url":"https://o3.security/vulnerability/CVE-2026-53713","summary":"Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure","details":"### Impact\n\nThe `to_absolute_normalized_path` function (security.lua:28-43) does not collapse redundant path separators (// → /). On Linux, `//etc/passwd` is equivalent to `/etc/passwd` (POSIX path semantics), but `is_critical_path` fails to match the double-slash variant because `//etc/passwd` does not start with `/etc/`.\n\nThis allows Lua code submitted as an `EnvoyExtensionPolicy` to read arbitrary files from the gateway controller pod's filesystem during Strict validation (the default), including:\n\n* `/etc/passwd`\n* Kubernetes SA tokens via `//var/run/secrets/kubernetes.io/serviceaccount/token`\n* TLS certificates via `//certs/...`\n* Process environment via `//proc/self/environ`\n\nThese credentials can be used to read sensitive information from the K8s API Server or from the Gateway XDS server.\n\n### Patches\n\nThis has been patched in versions >= v1.7.4 and v1.8.1\n\n  - Collapse redundant path separators (`//` to `/`) so double-slash variants like `//etc/passwd` and `//var/run/secrets/...` are matched by the critical-path check.\n  - Rewrite the traversal check to reject any `.` or `..` segment in any position and across both separator styles (catches `/etc/./passwd`, `./etc/passwd`, `/etc/.`).\n\n### Workarounds\nPlease refer to the `Warning` section in [Lua docs](https://gateway.envoyproxy.io/v1.8/tasks/extensibility/lua/) for measures to reduce risk.\n\n### Credits\n\nEnvoy Gateway thanks @dashingDragon and @Donjon-Cerberus for reporting this issue.","published":"2026-09-14T20:11:02.561Z","modified":"2026-10-21T02:58:30.156324359Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"},"epss":{"score":0.00414,"percentile":0.3526,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/envoyproxy/gateway","fixedVersion":"1.8.1"},{"ecosystem":"Go","name":"github.com/envoyproxy/gateway","fixedVersion":"1.7.4"}],"fix":{"url":"https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464","label":"envoyproxy/gateway@5a78db8"},"references":[{"type":"WEB","url":"https://github.com/envoyproxy/gateway/releases/tag/v1.7.4"},{"type":"WEB","url":"https://github.com/envoyproxy/gateway/releases/tag/v1.8.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53713.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53713"},{"type":"FIX","url":"https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464"},{"type":"FIX","url":"https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7"},{"type":"FIX","url":"https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead"},{"type":"FIX","url":"https://github.com/envoyproxy/gateway/pull/9171"},{"type":"FIX","url":"https://github.com/envoyproxy/gateway/pull/9172"},{"type":"FIX","url":"https://github.com/envoyproxy/gateway/pull/9173"},{"type":"PACKAGE","url":"https://github.com/envoyproxy/gateway"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:30.156324359Z"}}