CVE-2026-53713
Description
A flaw was found in Envoy Gateway. An authenticated attacker with permissions to submit Lua extension policies can bypass file path restrictions by submitting paths containing redundant slashes. This flaw allows the attacker to read arbitrary files from the gateway controller container, resulting in sensitive information disclosure. Exposed data can include Kubernetes service account tokens, Transport Layer Security (TLS) certificates, and process environment variables, potentially granting unauthorized access to the Kubernetes cluster.
Statement
A critical flaw was found in Envoy Gateway, an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. The to_absolute_normalized_path function in internal/gatewayapi/luavalidator/security.lua does not collapse redundant path separators before is_critical_path evaluates Lua code submitted through an EnvoyExtensionPolicy under the default Strict validation. Because Linux resolves a path containing redundant separators, such as a double slash, as its normalized single-separator form, an authenticated attacker with permission to submit Lua extension policies can bypass the file path restrictions and read arbitrary files from the gateway controller container. Exposed data can include Kubernetes service-account tokens, TLS certificates, and process environment variables, and the disclosed credentials can provide unauthorized access to sensitive Kubernetes API Server or Gateway xDS server information. This flaw is rated critical with a CVSS 3.1 score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), matching the upstream severity. No Red Hat products are affected: in Red Hat Connectivity Link 1.3 and 1.4, Envoy Gateway is not a supported gateway (it is only an upstream target for the operator, which uses OpenShift Service Mesh as the gateway provider), EnvoyExtensionPolicy resources are not used in the product path, and extensions use WASM rather than Lua, so the vulnerable luavalidator/security.lua code path is never executed.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.1 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
