CVE-2026-53718: Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

July 16, 2026

Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching Gateway API ReferenceGrant in the target namespace. This breaks the Gateway API cross-namespace consent model: the namespace that owns the referenced backend resource does not need to opt in with a ReferenceGrant before another namespace’s HTTPRoute can use that resource.

References

github.com/advisories/GHSA-fcrp-7gc2-93g7
github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7
nvd.nist.gov/vuln/detail/CVE-2026-53718

Code Behaviors & Features

Detect and mitigate CVE-2026-53718 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →