Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization. The persistent object triggers the panic on every reconcile; recovery in message/watchutil.go keeps the process alive but unwinds the runner/runner.go handle callback, stalling controller-wide xDS and infrastructure intermediate-representation publishing until an administrator deletes the object. The data plane continues to serve the last known good configuration while publication is stalled. This issue is fixed in versions 1.7.4 and 1.8.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T21:17:13.307Z",
  "pubdate": "2026-09-14T21:17:13.307Z",
  "executiveSummary": "Envoy Gateway is susceptible to a denial-of-service vulnerability due to an improper null pointer dereference within the control plane's reconciliation logic.\nThe vulnerability arises when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute that omits the 'spec.authorization' field.\nThis triggers a persistent panic during the reconciliation process, effectively stalling the controller's ability to update xDS configurations and intermediate-representation (IR) for the entire infrastructure.\nWhile the data plane continues to operate using the last known good configuration, the control plane's inability to process new updates prevents any administrative changes or security policy enforcement for new services.\nAn attacker with the ability to create or modify SecurityPolicy objects within a Kubernetes namespace can trigger this state, leading to a permanent suspension of control plane operations until the malformed object is manually removed by an administrator.\nThis vulnerability affects Envoy Gateway versions prior to 1.7.4 and 1.8.1.",
  "technicalDetails": "The root cause of the vulnerability resides in the translateSecurityPolicyForRoute function located in internal/gatewayapi/securitypolicy.go. The function fails to perform necessary validation or nil-checking on the authorization field within the SecurityPolicy resource before dereferencing it.\nWhen a user defines a SecurityPolicy targeting a TCPRoute but fails to provide a value for 'spec.authorization', the internal object model contains a nil pointer. The reconciliation loop, intended to translate Gateway API resources into xDS and IR configurations, attempts to access this nil reference, resulting in a runtime panic.\nThe attack flow follows a predictable sequence: First, an authenticated user with sufficient RBAC permissions to create or update SecurityPolicy objects in a namespace submits a resource definition that targets a TCPRoute while omitting the mandatory-to-the-logic 'spec.authorization' field. Second, the Envoy Gateway controller picks up this resource during its periodic watch and reconcile cycle. Third, the controller enters the handle callback in runner/runner.go, invokes the flawed translateSecurityPolicyForRoute function, and triggers the panic due to the nil dereference.\nAlthough the recovery mechanism implemented in message/watchutil.go prevents the entire controller process from crashing, it forces an unwind of the runner's execution context. Because the panic is deterministic and triggered by the persistent state of the malformed SecurityPolicy object, every subsequent reconciliation cycle for this object triggers the same crash. This causes a 'reconcile loop death spiral' where the controller's worker queue is perpetually blocked by the faulty resource.\nThe impact is a complete stall of the control plane's configuration pipeline. While the Envoy proxies (the data plane) maintain connectivity using cached configurations, any new routing rules, TLS updates, or security policy changes are effectively blocked across the entire cluster. This creates a state of configuration lock, preventing administrative intervention via standard Gateway API workflows and requiring manual intervention to delete the offending object from the Kubernetes API server."
}