CVE-2026-53719

Name of the Vulnerable Software and Affected Versions Envoy Gateway (affected versions not specified)

Description A nil-dereference occurs when a SecurityPolicy targets a TCPRoute that lacks the spec.authorization field. A namespace-scoped tenant can cause the gatewayapi runner to panic during every reconcile process using a single Custom Resource Definition (CRD). While the process remains active due to a recovery mechanism in message/watchutil.go, the handle() function in runner/runner.go is unwound, causing xDS/Infra IR publishing to stall across the entire controller until an administrator deletes the object. The data plane continues to serve the last known good configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.