Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-14T21:17:12.520Z",
  "pubdate": "2026-09-14T21:17:12.520Z",
  "executiveSummary": "Envoy Gateway is susceptible to a path traversal vulnerability originating from improper path normalization within the Lua validator component.\nThe vulnerability allows unauthorized entities to bypass security checks and read sensitive files from the gateway controller pod, including Kubernetes service-account tokens, TLS certificates, and environment variables.\nThis issue affects Envoy Gateway versions prior to 1.7.4 and 1.8.1.\nThe root cause lies in the 'to_absolute_normalized_path' function in 'internal/gatewayapi/luavalidator/security.lua', which fails to collapse redundant path separators (e.g., '//') before validation.\nAn attacker capable of submitting Lua code through an 'EnvoyExtensionPolicy' can exploit this discrepancy to access arbitrary files, potentially leading to unauthorized access to the Kubernetes API Server or internal xDS configuration data.\nThe risk is high, as the disclosure of service-account tokens can facilitate lateral movement within a Kubernetes cluster or escalation of privileges.",
  "technicalDetails": "The vulnerability resides within the 'to_absolute_normalized_path' function located in 'internal/gatewayapi/luavalidator/security.lua'. This function is responsible for normalizing paths used during the validation of Lua code submitted via 'EnvoyExtensionPolicy' under the default 'Strict' validation mode.\nThe technical root cause is an insufficient path normalization logic that fails to account for redundant separators, specifically double-slashes (//). While the Envoy Gateway's Lua validator logic treats redundant paths as distinct strings, the underlying Linux filesystem resolves absolute paths containing redundant separators to their single-slash equivalents (e.g., '/etc//passwd' resolves to '/etc/passwd').\nBecause the validator does not perform canonicalization or collapse these separators, the security checks intended to restrict file access are bypassed. An attacker can craft a malicious path containing redundant separators to circumvent the filter, effectively escaping the intended directory constraints.\nThe exploitation flow involves the attacker submitting a crafted 'EnvoyExtensionPolicy' that includes Lua code designed to read arbitrary files from the filesystem. By prepending redundant separators to a sensitive file path, the attacker tricks the validation mechanism into viewing the path as non-critical or safe, while the Linux runtime resolves the path to the desired sensitive resource.\nSuccessful exploitation grants the attacker read access to high-value assets stored within the gateway controller pod. This includes, but is not limited to, Kubernetes service-account tokens (allowing for impersonation of the controller's service account), TLS certificates utilized for secure communication, and environment variables which may contain sensitive keys or configuration parameters.\nThe impact of this vulnerability is significant, as the compromised data, particularly the service-account tokens, can be leveraged to query the Kubernetes API Server, extract cluster secrets, or gain unauthorized visibility into the xDS (Discovery Service) configuration managed by the Gateway. This essentially transitions the exploit from a local file read into a full control-plane compromise scenario for the affected gateway deployment.\nThe vulnerability is present in all versions of Envoy Gateway prior to 1.7.4 and 1.8.1. There is no indication that authentication is a prerequisite if the 'EnvoyExtensionPolicy' resource is exposed to the attacker, nor are there specialized privilege requirements beyond the ability to manage gateway policy resources."
}