CVE-2026-53718

Name of the Vulnerable Software and Affected Versions Envoy Gateway versions prior to 1.7.4 Envoy Gateway versions prior to 1.8.1

Description Envoy Gateway allows extension-managed custom backendRefs from an HTTPRoute to a backend resource in a different namespace without requiring a corresponding ReferenceGrant in the target namespace. This bypasses the Gateway API cross-namespace consent model, which is designed to ensure that a namespace owning a backend resource must explicitly opt in before that resource can be used by an HTTPRoute from another namespace.

Recommendations Update to version 1.7.4. Update to version 1.8.1.