When Envoy Gateway runs in GatewayNamespaceMode (provider.kubernetes.deploy.type=GatewayNamespace), the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary (Fetch) RPC methods for all registered discovery services. Since there is no unary interceptor, these Fetch endpoints are completely unauthenticated. Additionally, the JWT authentication interceptor in GatewayNamespaceMode only validates tokens when the received gRPC message is of type discoveryv3.DeltaDiscoveryRequest …
Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions (4): Tenant can create EnvoyExtensionPolicy (baseline) Attacker hosts a gzip-bomb at a reachable URL sha256 unset (optional field; check is post-decompression anyway) No operator Wasm-URL allowlist (none exists in code) Description getFileFromGZ calls io.ReadAll on a raw gzip.Reader (httpfetcher.go:216) with no output bound, while the compressed input is capped at 256 MiB (httpfetcher.go:139). The …
Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions (4): Pod-network reachability to :18002 (no auth) Tenant can create EnvoyExtensionPolicy (baseline) Attacker pod floods GET while churning EnvoyExtensionPolicy with distinct Wasm URLs Read at :153 must overlap a write at :201/:209 (probabilistic, attacker controls both rates) Description: httpserver.go:153 reads s.mappingPath2Cache with no lock while httpserver.go:201/209 write it under s.Lock(); the struct uses a …
Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions (4): Tenant can create EnvoyExtensionPolicy (baseline) Controller has egress to attacker-controlled OCI registry No registry allowlist (none exists in code) Layer presents Docker/OCI media type Description At imagefetcher.go:287, make([]byte, h.Size) uses the attacker-controlled tar-header size; the LimitReader at :278 bounds bytes read from the stream but not the header-declared size returned by tr.Next() (a …
Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions (4): Tenant has SecurityPolicy + TCPRoute RBAC (baseline) Tenant namespace permitted to attach TCPRoute to a Gateway listener spec.authorization omitted (the trigger) No admission webhook blocks the shape Description: A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but …
The to_absolute_normalized_path function (security.lua:28-43) does not collapse redundant path separators (// → /). On Linux, //etc/passwd is equivalent to /etc/passwd (POSIX path semantics), but is_critical_path fails to match the double-slash variant because //etc/passwd does not start with /etc/. This allows Lua code submitted as an EnvoyExtensionPolicy to read arbitrary files from the gateway controller pod's filesystem during Strict validation (the default), including: /etc/passwd Kubernetes SA tokens via //var/run/secrets/kubernetes.io/serviceaccount/token TLS certificates …
Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching Gateway API ReferenceGrant in the target namespace. This breaks the Gateway API cross-namespace consent model: the namespace that owns the referenced backend resource does not need to opt in with a ReferenceGrant before another namespace’s HTTPRoute can use that resource.
Envoy Gateway allows users to create Lua scripts that are executed by Envoy proxy using the EnvoyExtensionPolicy resource. Administrators can use Kubernetes RBAC to grant users the ability to create EnvoyExtensionPolicy resources. Lua scripts in policies are executed in two contexts: An EnvoyExtensionPolicy can be attached to Gateway and xRoute resources. Lua scripts in the policy will process traffic in that scope. Lua scripts are interpreted and run by the …