CVE-2026-53719: 
Wolfi vulnerability analysis and mitigation

CVE-2026-53719 is a NULL Pointer Dereference (CWE-476) vulnerability in Envoy Gateway, an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. The flaw exists in translateSecurityPolicyForRoute within internal/gatewayapi/securitypolicy.go, where a nil authorization value is dereferenced when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute while omitting spec.authorization. It affects all Envoy Gateway versions prior to 1.7.4 and versions 1.8.0-rc.0 through 1.8.0 (prior to 1.8.1). The vulnerability was disclosed on June 5, 2026, via GitHub Security Advisory GHSA-m2v6-2jmh-4c68, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is a missing nil-check in translateSecurityPolicyForRoute (internal/gatewayapi/securitypolicy.go): when processing a SecurityPolicy that targets a TCPRoute and omits spec.authorization, the code unconditionally dereferences the authorization pointer, triggering a Go panic (CWE-476). The recover() handler in message/watchutil.go:53 prevents process termination, but it unwinds the entire handle() callback in runner/runner.go:192, stalling controller-wide xDS and infrastructure IR publishing for all routes — not just the offending one. Exploitation requires four preconditions: the tenant must have RBAC permissions for both SecurityPolicy and TCPRoute, the tenant namespace must be permitted to attach a TCPRoute to a Gateway listener, spec.authorization must be omitted, and no admission webhook must block the malformed object. The fix, introduced in PRs #9171–#9173, adds a nil guard (if authorization != nil) before dereferencing (GitHub Advisory, PR #9172).

A low-privileged tenant with namespace-scoped RBAC can deterministically stall the Envoy Gateway controller's xDS and infrastructure IR publishing on every reconcile loop by creating a single malformed SecurityPolicy CRD. While the data plane continues serving the last known good configuration, no new configuration updates — including security policy changes, route additions, or infrastructure changes — are propagated controller-wide until an administrator manually deletes the offending object. This creates configuration drift and service inconsistency across all tenants sharing the gateway, with no confidentiality or integrity impact but a high availability impact on the control plane (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-53719. The EPSS score is approximately 0.685%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting that the attacker must have pre-existing low-privileged namespace access within the Kubernetes cluster (GitHub Advisory).

1. Gain namespace-scoped access: Obtain low-privileged credentials in a Kubernetes namespace that has RBAC permissions to create SecurityPolicy and TCPRoute resources, and where the namespace is permitted to attach a TCPRoute to a Gateway listener.
2. Create a TCPRoute: Deploy a TCPRoute resource in the permitted namespace targeting a valid Gateway listener (e.g., a TCP listener on port 8088).
3. Create a malformed SecurityPolicy: Apply a SecurityPolicy resource targeting the TCPRoute with spec.authorization entirely omitted. No admission webhook must be present to block this shape.
4. Trigger the panic: On the next reconcile cycle, the Envoy Gateway controller's translateSecurityPolicyForRoute function dereferences the nil authorization pointer, causing a Go panic.
5. Observe impact: The recover() in message/watchutil.go keeps the process alive but unwinds the handle() callback in runner/runner.go, stalling xDS and infrastructure IR publishing controller-wide. The malformed object persists and re-triggers the panic on every subsequent reconcile until an administrator deletes it (GitHub Advisory).

• Logs: Repeated Go panic stack traces in Envoy Gateway controller logs referencing internal/gatewayapi/securitypolicy.go and translateSecurityPolicyForRoute; recovery messages from message/watchutil.go:53 appearing on every reconcile interval.
• Kubernetes Events: Stalled or absent xDS/IR publishing events for all routes in the cluster; absence of new EnvoyPatchPolicy or route reconciliation events after the malformed object is created.
• Kubernetes Resources: Presence of a SecurityPolicy resource targeting a TCPRoute with no spec.authorization field in a tenant namespace; this object persisting without deletion is the persistent trigger.
• Control Plane Behavior: Configuration changes (new routes, policy updates) not being reflected on the data plane despite being applied to the Kubernetes API server, indicating a stalled controller reconciliation loop (GitHub Advisory).

Upgrade Envoy Gateway to version 1.7.4 (for the 1.7.x branch) or 1.8.1 (for the 1.8.x branch), which include the nil-guard fix in securitypolicy.go. As an immediate workaround prior to patching, an administrator can delete the offending SecurityPolicy object that targets a TCPRoute without spec.authorization to restore normal controller reconciliation. Additionally, deploying an admission webhook that rejects SecurityPolicy resources targeting TCPRoute without a valid spec.authorization field can prevent exploitation in multi-tenant environments (GitHub Advisory, v1.7.4 Release, v1.8.1 Release).