Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kgateway-dev/kgateway

              main @ 73b6acd
            

Fixes

CVEs

HIGH

Peak severity

51.4%

Coverage

Highlights

Denial of Service: 46 prior fixes. Scrutinize any change in this area.

Helm: most-fixed (6 issues). Treat as high-risk during review.

36 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Cross-namespace resource references (such as FrontendTLS CA certs) were validated against the incorrect namespace instead of the direct Gateway namespace, bypassing access controls. Ensure namespace resolution is strictly derived from the reference owner namespace.

Auth Bypass: The xDS control-plane lacked enforced authentication by default, allowing unauthorized proxy registrations. This aligns with CVE-2025-64323, where unauthenticated clients can connect to retrieve sensitive configuration data. Ensure JWT or mTLS auth is enabled by default.

Denial of Service: Critical race conditions and nil pointer dereferences inside gateway validation routines can lead to control plane panics and Envoy configuration rejection. Thread-safe locking and defensive nil checks must protect shared configuration snapshots.