Most recent entries from all

CLEANSTART-2026-XJ72729 — Security fix for CVE-2026-53718 applied in: tigera-operator 1.39.3-r1, tigera-operator-fips 1.37.2-r4, tigera-operator-…

Affected: CleanStart: tigera-operator, CleanStart: tigera-operator-fips

CVE-2026-53718 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-368532

fkie_cve-2026-53718

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.

GHSA-fcrp-7gc2-93g7 — Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

Affected: Go: github.com/envoyproxy/gateway

### Impact Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching Gateway API ReferenceGrant in the target namespace. This breaks the Gateway API cross-namespace consent model: the namespace that owns the referenced backend resource does not need to opt in with a ReferenceGrant before another namespace’s HTTPRoute can use that resource.

### Patches [1.7.4](https://github.com/envoyproxy/gateway/releases/tag/v1.7.4) [1.8.1](https://github.com/envoyproxy/gateway/releases/tag/v1.8.1)