{"id":"EUVD-2026-78072","enisaUuid":"c0e4ad21-0a80-36a3-a50e-8dd0f85f3f0c","description":"Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner\u0027s consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.","datePublished":"Sep 14, 2026, 8:12:12 PM","dateUpdated":"Sep 15, 2026, 1:55:25 PM","baseScore":6.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7\nhttps://github.com/envoyproxy/gateway/pull/9171\nhttps://github.com/envoyproxy/gateway/pull/9172\nhttps://github.com/envoyproxy/gateway/pull/9173\nhttps://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464\nhttps://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7\nhttps://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead\nhttps://github.com/envoyproxy/gateway/releases/tag/v1.7.4\nhttps://github.com/envoyproxy/gateway/releases/tag/v1.8.1\n","aliases":"CVE-2026-53718\nGHSA-fcrp-7gc2-93g7\n","assigner":"GitHub_M","epss":0.41,"enisaIdProduct":[{"id":"120e1af6-1337-33ed-9072-9b8e214620bd","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"\u003c 1.7.4"},{"id":"4e9c332b-1f29-34c7-97e3-947cf71f01d5","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"1.8.0-rc.0, \u003c 1.8.1"}],"enisaIdVendor":[{"id":"82499c89-b3bf-3677-ad64-97672bbea31e","vendor":{"name":"envoyproxy"}}],"enisaIdVulnerability":[{"id":"d2d16de9-5d30-3eb5-b99e-64876674646e","vulnerability":{"id":"CVE-2026-53718","description":"Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner\u0027s consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.","datePublished":"Sep 14, 2026, 8:12:12 PM","dateUpdated":"Sep 15, 2026, 1:55:25 PM","status":"PUBLISHED","baseScore":6.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7\nhttps://github.com/envoyproxy/gateway/pull/9171\nhttps://github.com/envoyproxy/gateway/pull/9172\nhttps://github.com/envoyproxy/gateway/pull/9173\nhttps://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464\nhttps://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7\nhttps://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead\nhttps://github.com/envoyproxy/gateway/releases/tag/v1.7.4\nhttps://github.com/envoyproxy/gateway/releases/tag/v1.8.1\n","enisa_id":"EUVD-2026-78072\n","assigner":"GitHub_M","epss":0.41,"dataProcessed":"Nov 1, 2026, 7:17:24 AM","vulnerabilityProduct":[{"id":"c5acec4a-d0d3-3fcc-b306-e5c2491a18e0","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"\u003c 1.7.4"},{"id":"c815d496-a32a-38c2-a4f2-8e78481865d8","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"1.8.0-rc.0, \u003c 1.8.1"}],"vulnerabilityVendor":[{"id":"789f9b0b-a829-365a-8bcc-c831650a39cf","vendor":{"name":"envoyproxy"}}]}},{"id":"d5e5eac7-2481-3958-9e58-f461738664f3","vulnerability":{"id":"GHSA-fcrp-7gc2-93g7","description":"Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass","datePublished":"Jul 16, 2026, 7:14:50 PM","dateUpdated":"Jul 16, 2026, 7:14:50 PM","baseScore":0.0,"references":"https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7\nhttps://github.com/envoyproxy/gateway\n","enisa_id":"EUVD-2026-78072\n","aliases":"GHSA-fcrp-7gc2-93g7\nCVE-2026-53718\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}