CyberRota Analysis
AI-GeneratedKubernetes users utilizing Envoy Gateway versions prior to 1.7.4 and 1.8.1 are vulnerable to unauthorized access, as an HTTPRoute can reference backend resources in different namespaces without proper authorization, violating the Gateway API's intended cross-namespace security model. This flaw could lead to potential data exposure or manipulation by allowing unintended access to backend services. Organizations using affected versions should prioritize upgrading to the fixed releases to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.