Envoy Gateway: extension-managed backendRef skips ReferenceGrant checks across namespaces

Impact

The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, so an HTTPRoute using an extension-managed backendRef can bind to a resource in another namespace with no ReferenceGrant in the target namespace. That breaks the Gateway API consent model: the namespace owning the route decides unilaterally, and the namespace owning the backend never approves. In a multi-tenant GPU cluster where namespaces are the tenancy boundary, a tenant can publish traffic to another tenant's internal service - an inference endpoint, a model registry, a feature store - through the shared gateway, exposing data that was only ever meant to be reachable inside its own namespace. Exploitation requires the cluster to have an extension server configured and custom backend types in use, which is what keeps the complexity rating high.

Who can reach it

An authenticated tenant with RBAC to create HTTPRoutes in its own namespace, in a cluster that has an Envoy Gateway extension server providing custom backend resources. No access to the target namespace is needed.

What to do

Upgrade Envoy Gateway to 1.7.4 or 1.8.1 and restart the controller deployment; no node disruption. Until patched, audit existing HTTPRoutes for custom backendRefs pointing outside their own namespace and compare against the ReferenceGrants that actually exist, since the missing check means past bindings were never validated.

References

Related entries

• Kubernetes (kube-apiserver): Any user who can create a Service with externalIPs (or patch LB status) intercepts clusterCVE-2020-8554 · Kubernetes (kube-apiserver)Medium
• Kubernetes (kube-controller-manager): Half-blind SSRF from the controller manager into the cloud metadata serviceCVE-2020-8555 · Kubernetes (kube-controller-manager)Medium
• containerd: Environment variables from an unrelated image leak into a container, exposing another tenant's secretsCVE-2021-21334 · containerdMedium
• Docker / moby: /var/lib/docker subdirectories world-traversableCVE-2021-41091 · Docker / mobyMedium
• Argo CD: Repository access credentials leaked in error messages surfaced in the UI and logsCVE-2023-25163 · Argo CDMedium
• gVisor: Weak hashing and small seeds let a remote attacker derive a local IP and per-boot identifierCVE-2024-10026 · gVisorMedium