GHSA-wcrf-9vrr-854fPublished
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-53713 · Microsoft / collected KEV context
cve-program · CVE-2026-53713
- https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f
- https://github.com/envoyproxy/gateway/pull/9171
- https://github.com/envoyproxy/gateway/pull/9172
- https://github.com/envoyproxy/gateway/pull/9173
- https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464
- https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7
- https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead
- https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
- https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
euvd · EUVD-2026-78070
- https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f
- https://github.com/envoyproxy/gateway/pull/9171
- https://github.com/envoyproxy/gateway/pull/9172
- https://github.com/envoyproxy/gateway/pull/9173
- https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464
- https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7
- https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead
- https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
- https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
nvd · CVE-2026-53713
- https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464
- https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7
- https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead
- https://github.com/envoyproxy/gateway/pull/9171
- https://github.com/envoyproxy/gateway/pull/9172
- https://github.com/envoyproxy/gateway/pull/9173
- https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
- https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
- https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f
osv · GHSA-wcrf-9vrr-854f
- https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f
- https://github.com/envoyproxy/gateway
osv · GO-2026-6011
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.