envoyproxy Envoy Gateway up to 1.7.3/1.8.0 luavalidator security.lua to_absolute_normalized_path input validation

Summaryinfo

A vulnerability was found in envoyproxy Envoy Gateway up to 1.7.3/1.8.0. It has been classified as very critical. This issue affects the function to_absolute_normalized_path of the file internal/gatewayapi/luavalidator/security.lua of the component luavalidator. Performing a manipulation results in input validation. This vulnerability is reported as CVE-2026-53713. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in envoyproxy Envoy Gateway up to 1.7.3/1.8.0. It has been classified as very critical. This affects the function to_absolute_normalized_path of the file internal/gatewayapi/luavalidator/security.lua of the component luavalidator. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-53713 since 06/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/14/2026).

Upgrading to version 1.7.4 or 1.8.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• envoyproxy

Name

• Envoy Gateway

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.8.0

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion