CVE-2026-53714

Name of the Vulnerable Software and Affected Versions Envoy Gateway (affected versions not specified)

Description When operating in GatewayNamespaceMode (provider.kubernetes.deploy.type=GatewayNamespace), the xDS gRPC server lacks a UnaryInterceptor, leaving Fetch endpoints unauthenticated. Furthermore, the JWT authentication interceptor only validates tokens for discoveryv3.DeltaDiscoveryRequest messages. If a discoveryv3.DiscoveryRequest is used—which is part of the State-of-the-World (SotW) xDS protocol—the authentication validation is skipped. This allows any pod in the cluster with network access to the xDS server on port 18000 to bypass authentication and access sensitive data, including TLS private keys via StreamSecrets (SDS), xDS resources via StreamAggregatedResources (ADS), backend endpoints via StreamClusters and StreamEndpoints (CDS/EDS), and routing rules via StreamRoutes and StreamListeners (RDS/LDS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.