70 matches found
CVE-2026-108334
A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...
CVE-2026-108334 Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...
CVE-2026-108334 Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...
EUVD-2026-102322
A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...
CVE-2026-108334 Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...
CVE-2026-108334
A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...
CVE-2026-108334
A flaw in the Kuadrant operator internal WebAssembly (WASM) shim allows for Expression Language Injection (CWE-917). When generating CEL predicates for Gateway-level authentication and rate limiting, the shim fails to correctly escape values from HTTPRoute match fields. An attacker with permissio...
CVE-2026-108334
A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...
WebAssembly code injection vulnerability
WebAssembly contains a code injection vulnerability. This vulnerability arises because the internal WebAssembly WASM shim used by the Kuadrant operator fails to properly escape values within HTTPRoute matching fields when generating CEL predicates. As a result, users capable of creating or...
CVE-2026-108334: Improper Neutralization of Special Elements used in an Expression Language Statement
A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...
PT-2026-115116
Name of the Vulnerable Software and Affected Versions Kuadrant operator affected versions not specified Description A flaw exists in the internal WebAssembly WASM shim used by the operator. The shim fails to correctly escape values from HTTPRoute match fields when generating the Common Expression...
CVE-2026-53718
A flaw was found in Envoy Gateway. An attacker could exploit a vulnerability in how HTTPRoute handles custom backend references. This allows a route-owning namespace to access and utilize resources in another namespace without proper authorization, bypassing the intended Gateway API cross-namespa...
CVE-2026-53718 Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...
CVE-2026-53718
Envoy Gateway prior to 1.7.4 and 1.8.1 contains a cross-namespace authorization bypass in the custom-backend branch of internal/gatewayapi/route.go. The omitted validateBackendNamespace check allows an HTTPRoute to use an extension-managed custom backendRef to reference a backend resource in anot...
EUVD-2026-78072
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...
CVE-2026-53718
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...
CVE-2026-53718: Missing Authorization
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...
GO-2026-6205 Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port in github.com/traefik/traefik
Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port in github.com/traefik/traefik...
GO-2026-6198 Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion
Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...