Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
GHSA-fcrp-7gc2-93g7 · BIT-envoy-gateway-2026-53718 · CVE-2026-53718 · GO-2026-6007
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching Gateway API ReferenceGrant in the target namespace. This breaks the Gateway API cross-namespace consent model: the namespace that owns the referenced backend resource does not need to opt in with a ReferenceGrant before another namespace’s HTTPRoute can use that resource.
Patches
Ready to move
Start Securing
Free, no credit card | First findings in minutes