Most recent entries from all

CLEANSTART-2026-XZ22302 — Security fix for CVE-2026-53719 applied in: tigera-operator 1.39.3-r1, tigera-operator-fips 1.37.2-r4, tigera-operator-…

Affected: CleanStart: tigera-operator, CleanStart: tigera-operator-fips

CVE-2026-53719 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

fkie_cve-2026-53719

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization. The persistent object triggers the panic on every reconcile; recovery in message/watchutil.go keeps the process alive but unwinds the runner/runner.go handle callback, stalling controller-wide xDS and infrastructure intermediate-representation publishing until an administrator deletes the object. The data plane continues to serve the last known good configuration while publication is stalled. This issue is fixed in versions 1.7.4 and 1.8.1.

GHSA-m2v6-2jmh-4c68 — Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

Affected: Go: github.com/envoyproxy/gateway

Vulnerability report without repro case. Repro case may be added later after harness is complete.

**Preconditions (4):** - Tenant has SecurityPolicy + TCPRoute RBAC (baseline) - Tenant namespace permitted to attach TCPRoute to a Gateway listener - spec.authorization omitted (the trigger) - No admission webhook blocks the shape

**Description:**

A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but unwinds the entire handle() callback in runner/runner.go:192, so xDS/Infra IR publishing stalls controller-wide until an admin deletes the object. Data plane keeps serving last-good config.