PT-2026-60691 · Go · Github.Com/Envoyproxy/Ai-Gateway

CVE-2026-53719 · Publicado 2026-07-16 · Atualizado 2026-07-16

OSV

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Vulnerability report without repro case. Repro case may be added later after harness is complete.

Preconditions (4):

• Tenant has SecurityPolicy + TCPRoute RBAC (baseline)
• Tenant namespace permitted to attach TCPRoute to a Gateway listener
• spec.authorization omitted (the trigger)
• No admission webhook blocks the shape

Description:

A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but unwinds the entire handle() callback in runner/runner.go:192, so xDS/Infra IR publishing stalls controller-wide until an admin deletes the object. Data plane keeps serving last-good config.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2026-53719

GHSA-M2V6-2JMH-4C68

Produtos afetados

Github.Com/Envoyproxy/Ai-Gateway

Referências · 3

• https://github.com/envoyproxy/gateway/security/advisories/GHSA-m2v6-2jmh-4c68 · Nota
• https://github.com/envoyproxy/gateway · Nota
• https://osv.dev/vulnerability/GHSA-m2v6-2jmh-4c68 · Aviso do Fabricante