Envoy Gateway: a SecurityPolicy on a TCPRoute without spec.authorization panics translation and stalls xDS

Impact

A namespace-scoped tenant that creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization causes translateSecurityPolicyForRoute to dereference a nil value. The panic recovery in message/watchutil.go keeps the process alive but unwinds the runner handle callback, so controller-wide xDS and infrastructure IR publishing stop. The object persists, so the panic repeats on every reconcile until an administrator deletes it. The data plane keeps serving its last known good configuration, which is what keeps this from being a traffic outage - but no configuration change lands for any namespace in the meantime, so route updates, endpoint changes and policy edits silently do nothing. That is a quiet failure mode: operators draining GPU nodes or rolling inference deployments will see the gateway continue sending traffic to configuration that no longer matches reality.

Who can reach it

Any authenticated tenant with RBAC to create a SecurityPolicy in a namespace that owns a TCPRoute. No cluster-level access needed, and the trigger is a plausible accident, not just an attack.

What to do

Upgrade Envoy Gateway to 1.7.4 or 1.8.1 and restart the controller deployment. To clear the condition now, find and delete the SecurityPolicy that targets a TCPRoute with no spec.authorization; publishing resumes without a data-plane interruption. Alert on xDS publish staleness rather than only on gateway pod health, since the process stays up.

References

Related entries

• Submariner: IPsec pre-shared key stored unencrypted in the Submariner custom resourceCVE-2026-66781 · Submariner operator (Submariner CR, IPsec pre-shared key)Medium
• KubeSphere cluster-controller: Cluster CRD endpoint is fetched unvalidated, giving SSRF from the controller podCVE-2026-71208 · KubeSphere cluster-controller (Cluster CRD connection config, addCluster / Discovery.ServerVersion)Medium
• ECK operator: unvalidated secret reference lets a namespace-scoped user read secrets from any namespaceCVE-2026-72640 · Elastic Cloud on Kubernetes (ECK) operator (secret reference reconciliation)Medium
• Elastic Cloud on Kubernetes: Fleet Server Elasticsearch token written into the workload spec in cleartextCVE-2026-72648 · Elastic Cloud on Kubernetes (ECK) operator - Fleet Server workload specMedium
• Dokploy: compose service names are interpolated into shell commands, giving command execution on the Docker hostCVE-2026-72739 · Dokploy (compose deployment createCommand shell interpolation)Medium
• Kubernetes (kube-apiserver): Unvalidated redirect on proxied upgrade requests lets a compromised node escalate to otherCVE-2020-8559 · Kubernetes (kube-apiserver)Medium