Logo
Retour à la veille

CVE-2026-53719

Publié : 14 septembre 2026
Modifié : 16 septembre 2026
Lien officiel NVD
Score CVSS
6.5
MEDIUM

Description détaillée

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization. The persistent object triggers the panic on every reconcile; recovery in message/watchutil.go keeps the process alive but unwinds the runner/runner.go handle callback, stalling controller-wide xDS and infrastructure intermediate-representation publishing until an administrator deletes the object. The data plane continues to serve the last known good configuration while publication is stalled. This issue is fixed in versions 1.7.4 and 1.8.1.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eeadhttps://github.com/envoyproxy/gateway/pull/9171https://github.com/envoyproxy/gateway/pull/9172https://github.com/envoyproxy/gateway/pull/9173https://github.com/envoyproxy/gateway/releases/tag/v1.7.4https://github.com/envoyproxy/gateway/releases/tag/v1.8.1https://github.com/envoyproxy/gateway/security/advisories/GHSA-m2v6-2jmh-4c68

Dernières Vulnérabilités

CVE-2026-94034

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.

VOIR DÉTAILS

CVE-2026-94033

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_recommender/Admin/add_user of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

VOIR DÉTAILS

CVE-2026-94032

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

VOIR DÉTAILS