PT-2026-60690 · Go · Github.Com/Envoyproxy/Ai-Gateway

CVE-2026-53718 · Publicado 2026-07-16 · Atualizado 2026-07-16

OSV

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

Impact

Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching Gateway API ReferenceGrant in the target namespace. This breaks the Gateway API cross-namespace consent model: the namespace that owns the referenced backend resource does not need to opt in with a ReferenceGrant before another namespace’s HTTPRoute can use that resource.

Patches

1.7.4 1.8.1

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-53718

GHSA-FCRP-7GC2-93G7

Produtos afetados

Github.Com/Envoyproxy/Ai-Gateway

Referências · 3

• https://github.com/envoyproxy/gateway · Nota
• https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7 · Nota
• https://osv.dev/vulnerability/GHSA-fcrp-7gc2-93g7 · Aviso do Fabricante