Envoy Gateway: unauthenticated xDS on port 18000 hands out TLS private keys and full routing config

Impact

In GatewayNamespaceMode the xDS gRPC server installs a JWT StreamInterceptor but no UnaryInterceptor, so every unary Fetch RPC is unauthenticated; the streaming interceptor only type-asserts DeltaDiscoveryRequest, so a State-of-the-World DiscoveryRequest fails the assertion and is returned as success without any JWT validation. Any pod that can open a connection to port 18000 can pull TLS private keys via StreamSecrets, all endpoints, listeners, routes and clusters via the aggregated or per-type streams. On a shared GPU cluster that fronts inference endpoints through Envoy Gateway, one tenant pod with cluster network reach walks away with the certificates and the full internal topology - enough to impersonate any service the gateway terminates TLS for. Key compromise is not fixed by the patch alone.

Who can reach it

Any pod or host with network reach to the Envoy Gateway xDS port 18000 in a GatewayNamespaceMode deployment. No authentication required.

What to do

Upgrade Envoy Gateway to 1.7.4 or 1.8.1 and roll the control-plane deployment - a daemon restart, not a node action. Because private keys may already have been served to anything that could reach the port, treat the certificates handled by affected gateways as exposed and reissue them. Until the upgrade, restrict reachability of port 18000 with a NetworkPolicy that permits only the proxy pods.

References

Related entries

• Istio: Authentication Policy exact-path matching allows unauthorized access to HTTP pathsCVE-2020-8595 · IstioHigh
• containerd: Overly broad default permissions on containerd-managed directoriesCVE-2024-25621 · containerdHigh
• runc: Insufficient verification of masked-path bind mounts (/dev/null replaced by symlink) enables containerCVE-2025-31133 · runcHigh
• runc: Attacker misdirects runc writes to /proc via racing symlinksCVE-2025-52881 · runcHigh
• Traefik: Path traversal in the WASM plugin installation mechanismCVE-2025-54386 · TraefikHigh
• KubeVirt: safepath OpenAtNoFollow resolves via /proc/self/fd, defeating the symlink protectionCVE-2026-13201 · KubeVirtHigh