Envoy Gateway: path-normalization gap in the Lua validator lets submitted Lua read controller pod files

Impact

A tenant able to create an EnvoyExtensionPolicy can submit Lua that the Strict validator accepts because the critical-path check runs before redundant separators are collapsed, so a double-slash path bypasses the deny list while Linux resolves it normally. The Lua then reads arbitrary files inside the gateway controller pod: the Kubernetes service-account token, TLS keys and certificates, and process environment. Those credentials reach the Kubernetes API server and the xDS server that programs every data-plane proxy, so a single namespace tenant can pivot into cluster-wide control over ingress for all tenants. On a shared GPU cluster where the gateway fronts inference endpoints, that means the ability to read or redirect other tenants' traffic, not just a local file disclosure.

Who can reach it

Any authenticated user with permission to create or update an EnvoyExtensionPolicy in a namespace the gateway watches - no access to the controller node or the management network is needed (CVSS PR:L, AV:N).

What to do

Upgrade Envoy Gateway to 1.7.4 or 1.8.1 and roll the controller deployment; no node drain or data-plane outage is required beyond the controller restart. Until then, restrict who can create EnvoyExtensionPolicy objects via RBAC, and treat the controller's service-account token and gateway TLS material as exposed - rotate them and review Kubernetes API audit logs for use of that identity.

References

Related entries

• Argo CD: Stored XSS via a `javascript:` link executes in an admin's browserCVE-2022-31035 · Argo CDCritical
• Argo CD: Improper authorization causes the API to accept tokens it should rejectCVE-2023-22482 · Argo CDCritical
• AKS Confidential Containers: elevation of privilege across the confidential container boundaryCVE-2024-21400 · Azure Kubernetes Service Confidential Containers (az confcom tooling)Critical
• Argo CD: Improper URL protocol filtering in link annotations enables client-side attacks against adminsCVE-2024-28175 · Argo CDCritical
• Argo CD: An unprivileged pod in any namespace can reach the unauthenticated Argo CD Redis on 6379 and poisonCVE-2024-31989 · Argo CDCritical
• RHACM app-subscription: namespace edit rights escalate to cluster-admin via attacker-hosted Helm chartCVE-2026-10090 · Red Hat Advanced Cluster Management - multicluster-operators-subscription (app-subscription controller)Critical