Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53719— Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

Quick assessment

Affected
envoyproxy gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Envoy Gateway 是一个开源项目，用于将 Envoy Proxy 作为独立应用程序网关或基于 Kubernetes 的应用程序网关进行管理。 在 1.7.4 和 1.8.1 之前，位于 中的 函数在处理安全策略时会引用一个为空的授权值：当某个命名空间范围内的租户创建了一个针对 TCPRoute 的 SecurityPolicy，并且在 中省略了授权配置时，就会触发该问题。 这个持久化对象会在每次协调（reconcile）时触发 panic（空指针解引用）； 中的恢复机制虽然能让进程保持运行，但会导致 中的

CVSS 6.5 · Medium EPSS 0.12% · P31

Possible ATT&CK Techniques 1 AI

T1562
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53719

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
Source: CVE Program / CVE List V5
Vulnerability Description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization. The persistent object triggers the panic on every reconcile; recovery in message/watchutil.go keeps the process alive but unwinds the runner/runner.go handle callback, stalling controller-wide xDS and infrastructure intermediate-representation publishing until an administrator deletes the object. The data plane continues to serve the last known good configuration while publication is stalled. This issue is fixed in versions 1.7.4 and 1.8.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
envoyproxy gateway < 1.7.4 -

II. Public POCs for CVE-2026-53719

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53719

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53719 (3)

Vendor Advisories for CVE-2026-53719 (1)

Vendor Pages for CVE-2026-53719 (2)

Same Patch Batch · envoyproxy · 2026-09-14 · 7 CVEs total

CVE-2026-53713 9.1 CRITICAL Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy
CVE-2026-53714 7.4 HIGH Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in Gat
CVE-2026-53716 6.5 MEDIUM Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
CVE-2026-53717 6.5 MEDIUM Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar head
CVE-2026-53718 6.4 MEDIUM Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
CVE-2026-53715 5.3 MEDIUM Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

IV. Related Vulnerabilities

Same product: gateway
Same vendor: envoyproxy
Same weakness: CWE-476

V. Comments for CVE-2026-53719

No comments yet

Leave a comment