CVE-2026-53713

Name of the Vulnerable Software and Affected Versions Envoy Gateway versions prior to 1.7.4 Envoy Gateway versions prior to 1.8.1

Description The to absolute normalized path function (security.lua:28-43) fails to collapse redundant path separators, such as converting // to /. Due to POSIX path semantics on Linux, a path starting with // is treated as equivalent to one starting with /, but the is critical path check fails to identify these variants. This allows Lua code submitted via an EnvoyExtensionPolicy to bypass path validation and read arbitrary files from the gateway controller pod's filesystem, including /etc/passwd, Kubernetes service account tokens, TLS certificates, and process environment variables. These leaked credentials could potentially be used to access sensitive information from the K8s API Server or the Gateway XDS server.

Recommendations Update to version 1.7.4 or later. Update to version 1.8.1 or later.