CVE-2026-53714

HIGHPre-NVD 7.47.4—
EchelonGraph scoreMEDIUM confidence

This high-severity CVE scores 7.4 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.3%, top 79% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: epss, secondary
7.4EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 7.4Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC unauthenticated. The streaming interceptor also authenticates only discoveryv3.DeltaDiscoveryRequest messages; a discoveryv3.DiscoveryRequest used by the State-of-the-World protocol fails the type assertion and returns success without JWT validation. Any pod that can reach port 18000 can use the unauthenticated unary or State-of-the-World paths to retrieve TLS private keys through StreamSecrets, all xDS resources through StreamAggregatedResources, backend endpoints through StreamClusters or StreamEndpoints, and routing configuration through StreamRoutes or StreamListeners. This issue is fixed in versions 1.7.4 and 1.8.1.

CVSS v3
7.4
EG Score
7.4(medium)
EG Risk
33(Track)
EG Risk 33/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity74% × 45%
Exploitation0% × 40%
Automatability0% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
21%
KEV
Not listed

Published

July 16, 2026

Last Modified

September 15, 2026

Advisory Details (9)

Auto-updated Sep 14, 2026
Patch available. Sources: github, github_pr, github_commit, github_release.
github_release Patch Available

v1.8.1

Patch available: envoyproxy/gateway v1.8.1

https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
github_release Patch Available

v1.7.4

Patch available: envoyproxy/gateway v1.7.4

https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
github_commit

commit f1f9829af2a2 (envoyproxy/gateway)

Fix landed in envoyproxy/gateway commit f1f9829af2a2 — awaiting tagged release

https://github.com/envoyproxy/gateway/commit/f1f9829af2a231f0cae915c09800353c76622d97
github_commit

commit e9124abc4ff4 (envoyproxy/gateway)

Fix landed in envoyproxy/gateway commit e9124abc4ff4 — awaiting tagged release

https://github.com/envoyproxy/gateway/commit/e9124abc4ff4b63a218a6890c1b28a982c850465
github_commit

commit 4df0809ff1ed (envoyproxy/gateway)

Fix landed in envoyproxy/gateway commit 4df0809ff1ed — awaiting tagged release

https://github.com/envoyproxy/gateway/commit/4df0809ff1ed59ffb09604da4084335b8c6647c5
github_pr

[release/v1.8] fix: add unary interceptor and fix fail-open auth in GatewayNamespaceMode (#8986)

Fix merged in envoyproxy/gateway PR #9118 on 2026-05-30 — awaiting tagged release

https://github.com/envoyproxy/gateway/pull/9118
github_pr

[release/v1.7] fix: add unary interceptor and fix fail-open auth in GatewayNamespaceMode (#8986)

Fix merged in envoyproxy/gateway PR #9116 on 2026-05-29 — awaiting tagged release

https://github.com/envoyproxy/gateway/pull/9116
github_pr

fix: add unary interceptor and fix fail-open auth in GatewayNamespaceMode

Fix merged in envoyproxy/gateway PR #8986 on 2026-05-13 — awaiting tagged release

https://github.com/envoyproxy/gateway/pull/8986
github Patch Available

xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode · Advisory · envoyproxy/gateway · GitHub

https://github.com/envoyproxy/gateway/security/advisories/GHSA-22xc-xg2r-9j7v

Vendor Advisories for CVE-2026-53714(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(1 across 1 ecosystem)
Go(1)
PackageVulnerable rangeFixed inDependents
github.com/envoyproxy/gateway—1.8.1—

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Data Freshness Timeline

(refreshed 8× in last 7d / 8× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-09-18 19:28 UTCEPSS rescore
  2. 2026-09-18 04:38 UTCEG score recompute
  3. 2026-09-17 10:29 UTCEG score recompute
  4. 2026-09-16 14:08 UTCEPSS rescore
  5. 2026-09-16 05:15 UTCEPSS rescore
  6. 2026-09-15 20:47 UTCEG score recompute
  7. 2026-09-15 19:41 UTCEG score recompute
  8. 2026-09-14 21:33 UTCEG score recompute
  9. 2026-07-30 21:39 UTCEG score recompute
  10. 2026-07-26 11:24 UTCEG score recompute
  11. 2026-07-23 03:19 UTCEG score recompute
  12. 2026-07-16 20:04 UTCEG score recompute

Related CVEs(same CWE)

Frequently asked(5)

What is CVE-2026-53714?
CVE-2026-53714 is a high vulnerability published on July 16, 2026. Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but…
When was CVE-2026-53714 disclosed?
CVE-2026-53714 was first published in the National Vulnerability Database on July 16, 2026, with the most recent update on September 15, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-53714 actively exploited?
CVE-2026-53714 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 78.9% of all scored CVEs.
What is the CVSS score of CVE-2026-53714?
CVE-2026-53714 has a CVSS v3 base score of 7.4 (NVD).
How do I remediate CVE-2026-53714?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-53714, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-53714

Explore →

Is Your Infrastructure Affected by CVE-2026-53714?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs