PT-2026-60690 · Go · Github.Com/Envoyproxy/Ai-Gateway

CVE-2026-53718 · Published 2026-07-16 · Updated 2026-07-16

OSV

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

Impact

Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching Gateway API ReferenceGrant in the target namespace. This breaks the Gateway API cross-namespace consent model: the namespace that owns the referenced backend resource does not need to opt in with a ReferenceGrant before another namespace’s HTTPRoute can use that resource.

Patches

1.7.4 1.8.1

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-53718

GHSA-FCRP-7GC2-93G7

Affected Products

Github.Com/Envoyproxy/Ai-Gateway

References · 3

• https://osv.dev/vulnerability/GHSA-fcrp-7gc2-93g7 · Vendor Advisory
• https://github.com/envoyproxy/gateway · Note
• https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7 · Note