Package
tigera-operator-fips-1.38
Component
github.com/envoyproxy/gateway
Latest update
7.4
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
tigera-operator depends on github.com/envoyproxy/gateway v1.5.9 but imports only the CRD API type definitions (api/v1alpha1) used to register and render Gateway API custom resources. CVE-2026-53714 affects Envoy Gateway's xDS control-plane server (information disclosure under GatewayNamespaceMode), which is not imported, compiled, or linked into the operator binary. Verified via the compile-time import graph (go list -deps ./cmd) and the shipped binary's symbol table (go tool nm): api/v1alpha1 is the only linked envoyproxy/gateway package (1060 symbols) with zero symbols from the affected code, and govulncheck source-mode call traces reach only api/v1alpha1 DeepCopyObject/init. The operator does not run the Envoy Gateway control plane, so the vulnerable code is not present. Upstream fixed the flaw at the module level in Envoy Gateway 1.7.4/1.8.1; the fix is not applicable here because the affected code is absent. Refs: NVD CVE-2026-53714, GHSA-22xc-xg2r-9j7v.
Status