CVE-2026-53715: Envoy Gateway Control-Plane DOS Vulnerability

CVE-2026-53715 Overview

CVE-2026-53715 is a race condition vulnerability in Envoy Gateway, an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. The flaw resides in HTTPServer.ServeHTTP within internal/wasm/httpserver.go, where the mappingPath2Cache map is read without synchronization while HTTPServer.Get writes to the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to the unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can trigger Go's concurrent map read/write detection, invoking runtime.throw and terminating the controller process. The issue is categorized as [CWE-362] and is fixed in versions 1.7.4 and 1.8.1.

Critical Impact
Successful exploitation causes a cross-tenant control-plane denial of service, halting the Envoy Gateway controller until Kubernetes restarts the pod.

Affected Products

Envoy Gateway versions prior to 1.7.4
Envoy Gateway versions prior to 1.8.1
Deployments exposing the unauthenticated Wasm HTTP server on port 18002

Discovery Timeline

2026-09-14 - CVE-2026-53715 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-53715

Vulnerability Analysis

Envoy Gateway ships an internal HTTP server that serves compiled Wasm modules to Envoy data plane instances. The server maintains an in-memory cache, mappingPath2Cache, that maps request paths to cached Wasm payloads. The ServeHTTP handler reads this map on every inbound request, while the Get method mutates the map whenever the control plane translates an EnvoyExtensionPolicy referencing a new Wasm URL.

Because Go maps are not safe for concurrent read and write access, the runtime performs an internal data race check on every map operation. When a read and a write overlap, Go invokes runtime.throw, a fatal error that bypasses the standard net/http connection-level recover() handler. The controller process exits, forcing Kubernetes to restart the pod and disrupting policy reconciliation for every tenant sharing the control plane.

Root Cause

The root cause is missing synchronization on the shared mappingPath2Cache map in internal/wasm/httpserver.go. Neither a sync.Mutex nor a sync.Map guarded the concurrent access pattern between the HTTP request path and the policy translation path.

Attack Vector

Exploitation requires pod-network reachability to port 18002, which is exposed without authentication, plus tenant permission to create or modify EnvoyExtensionPolicy resources with distinct Wasm URLs. The attacker floods GET requests against cached paths while simultaneously churning policies to trigger cache writes. Once a reader and writer overlap, the controller aborts. The impact crosses tenant boundaries because a single shared controller serves all tenants.

The upstream fixes are distributed across three commits on the main, release-1.8, and release-1.7 branches. See the GitHub Security Advisory GHSA-8fv2-88gg-hm7q and the corresponding pull requests #9171, #9172, and #9173 for the full remediation set.

Detection Methods for CVE-2026-53715

Indicators of Compromise

Repeated Envoy Gateway controller pod restarts with exit reason Error and no preceding OOMKilled event.
Controller logs containing fatal error: concurrent map read and map write or runtime.throw stack traces referencing internal/wasm/httpserver.go.
High-volume GET request patterns targeting port 18002 from within the cluster pod network.
Rapid create/update/delete churn on EnvoyExtensionPolicy resources referencing distinct Wasm URLs.

Detection Strategies

Alert on Kubernetes CrashLoopBackOff or repeated restart counts for the envoy-gateway controller Deployment.
Parse controller stdout/stderr for Go runtime fatal error signatures and correlate with recent policy changes.
Baseline normal request rates to internal Wasm distribution endpoints and flag sustained deviations.

Monitoring Recommendations

Enable Kubernetes audit logging for EnvoyExtensionPolicy mutations and correlate with controller pod lifecycle events.
Ship controller logs and network flow telemetry to a centralized analytics platform for cross-signal correlation of restart events with in-cluster traffic spikes to port 18002.
Track pod-to-pod NetworkPolicy denials so unauthorized reachability to the Wasm HTTP server surfaces immediately.

How to Mitigate CVE-2026-53715

Immediate Actions Required

Upgrade Envoy Gateway to v1.7.4 or v1.8.1 depending on the deployed minor release line.
Restrict pod-network access to port 18002 using a Kubernetes NetworkPolicy that permits only the Envoy data plane pods.
Review RBAC bindings that grant tenants the ability to create or update EnvoyExtensionPolicy resources referencing arbitrary Wasm URLs.

Patch Information

The maintainers released fixes in Envoy Gateway v1.7.4 and v1.8.1. The relevant upstream changes are tracked in commits 5a78db8, 96e2b75, and b473718. Additional hardening in the same release includes a Lua validator update and cross-namespace ReferenceGrant enforcement for custom backends:

// internal/gatewayapi/route.go - patched behavior
				return emptyDS, nil, err
			}
		}
	} else {
		// Custom backend resources still require ReferenceGrant for cross-namespace references.
		if err = t.validateBackendNamespace(backendRef, route, resources, routeType); err != nil {
			return emptyDS, nil, err
		}
	}

	// Skip processing backends with 0 weight

Source: GitHub commit 5a78db8

Workarounds

Apply a NetworkPolicy that limits ingress on port 18002 to trusted Envoy data plane pods until the upgrade is deployed.
Temporarily disable tenant self-service creation of EnvoyExtensionPolicy resources that reference external Wasm URLs.
Configure Kubernetes liveness probes and pod restart budgets so controller crashes are surfaced promptly to on-call responders.

bash

# Example NetworkPolicy restricting access to the Wasm HTTP server port
kubectl apply -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-envoy-gateway-wasm
  namespace: envoy-gateway-system
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: envoy-gateway
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app.kubernetes.io/component: envoy
    ports:
    - protocol: TCP
      port: 18002
EOF