Envoy Gateway: unsynchronized Wasm cache map read/write crashes the controller process

Impact

HTTPServer.ServeHTTP reads the mappingPath2Cache map without a lock while HTTPServer.Get writes it during EnvoyExtensionPolicy translation. Go's concurrent map read/write detector calls runtime.throw, which net/http cannot recover from, so the whole controller process dies. Because the Envoy Gateway controller is shared cluster infrastructure, one tenant churning EnvoyExtensionPolicies with distinct Wasm URLs while flooding the unauthenticated port 18002 can stall gateway configuration for every other tenant until Kubernetes restarts the pod. Data plane proxies keep serving their last config, but no new routes or policies land during the outage.

Who can reach it

A workload with pod-network reachability to the controller's port 18002 (unauthenticated) plus namespace permission to create or edit EnvoyExtensionPolicy resources. Both are available to an ordinary tenant in a multi-tenant cluster unless network policy restricts the port.

What to do

Upgrade Envoy Gateway to 1.7.4 or 1.8.1 and let the controller deployment roll; this is a control-plane pod restart, not a node action, and the data plane keeps serving during the rollout. Until you can upgrade, restrict pod-network access to port 18002 with a NetworkPolicy and limit who can create EnvoyExtensionPolicy resources.

References

Related entries

• Podman: Malicious image WORKDIR symlink creates directories or changes ownership on the host filesystemCVE-2026-55686 · PodmanMedium
• BuildKit: invalid SecurityMode disables Seccomp and AppArmor without the insecure entitlementCVE-2026-61711 · BuildKit executor/oci/spec_linux.go (SecurityMode validation)Medium
• Helm: index-out-of-range panic rendering charts that contain empty filesCVE-2026-63308 · Helm (Files.Lines template helper, pkg/engine/files.go)Medium
• Traefik Gateway API provider: extensionRef resolved in the wrong namespace, letting a route bind an ungranted MiddlewareCVE-2026-65601 · Traefik Kubernetes Gateway API provider (HTTPRoute extensionRef namespace resolution)Medium
• Traefik: IngressRouteTCP ignores crossProviderNamespaces, letting any namespace borrow file-provider mTLS identityCVE-2026-65602 · Traefik (IngressRouteTCP serversTransport cross-provider allowlist)Medium
• JFrog Artifactory: authenticated write outside the Docker repository cache pathCVE-2026-66384 · JFrog Artifactory (Docker remote repository cache path)Medium