HIGH🇬🇧 English

CVE-2026-22771

CVSS 8.8v3.1pub. 2026-01-12upd. 2026-06-30

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Envoyproxy Gateway

    APP
    Envoyproxy
    < 1.5.71.6.0 – 1.6.2 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Container
CWE
Referencje

Powiązane podatności

CVE-2025-24030HIGH7.1ten sam produkt

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based applicati...

CVE-2025-25294MEDIUM5.3ten sam produkt

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based applicati...

CVE-2022-29226CRITICAL10.0PL ✓ten sam vendor

Envoy OAuth filter: pominięcie walidacji access tokena umożliwia nieautoryzowany dostęp

CVE-2019-18801CRITICAL9.8PL ✓ten sam vendor

Envoy 1.12.0: zapis poza buforami żądania HTTP/2 prowadzący do RCE lub bypass ACL

CVE-2019-18802CRITICAL9.8PL ✓ten sam vendor

Bypass mechanizmów kontroli dostępu przez białe znaki w nagłówkach HTTP w Envoy