{"id":"EUVD-2026-78072","revision":"bb85cf07a0484643955ec29b7c8ea91b","records":[{"revision":"bb85cf07a0484643955ec29b7c8ea91b","observedAt":"2026-11-01T09:17:04.424+00:00","statement":{"source":"euvd","id":"EUVD-2026-78072","aliases":["CVE-2026-53718","GHSA-fcrp-7gc2-93g7"],"title":"Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource …","description":"Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L","score":6.4,"severity":null}],"references":["https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7","https://github.com/envoyproxy/gateway/pull/9171","https://github.com/envoyproxy/gateway/pull/9172","https://github.com/envoyproxy/gateway/pull/9173","https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464","https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7","https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead","https://github.com/envoyproxy/gateway/releases/tag/v1.7.4","https://github.com/envoyproxy/gateway/releases/tag/v1.8.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78072","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 14, 2026, 8:12:12 PM","dateUpdated":"Sep 15, 2026, 1:55:25 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-78072","identifiers":["EUVD-2026-78072","CVE-2026-53718","GHSA-fcrp-7gc2-93g7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}