PT-2026-46945

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.35.11 Description An issue exists in the Envoy gateway related to HTTP/2, which can be exploited to cause a denial of service, potentially bringing down an Evonode. There have been reports of elevated activities...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: kubescape, teleport, containerd-fips, docker-cli-buildx-fips, skaffold-fips, opa, opa-fips-envoy, zot, spegel, grype-db, redpanda-operator, chainctl, kubevela-fips, consul-k8s-fips, cg, kubescape-server-fips, jfrog-cli, chartmuseum-fips, containerd, helm-exporter-fip...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: ferretdb, splunk-otel-collector-fips, teleport, gotrue-fips, spicedb, goose, dapr, gotrue, seaweedfs, commercial-chainloop-backend, pgwatch, hydra, spqr, peerdb-flow, spicedb-fips, sftpgo, harbor-fips, migrate, ory-kratos-fips, trillian-fips, step, cloudprober,...

CVE-2026-33816 vulnerabilities

Vulnerabilities for packages: spire-server, commercial-chainloop-backend, envoy-gateway-fips, k3s, commercial-expanso-edge, kine, envoy-gateway, kots, commercial-grafana...

GHSA-9JJ7-4M8R-RFCM vulnerabilities

Vulnerabilities for packages: spire-server, commercial-chainloop-backend, envoy-gateway-fips, k3s, commercial-expanso-edge, kine, envoy-gateway, kots, commercial-grafana...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: kubescape, teleport, kube-arangodb-fips, flux-source-controller-fips, istio, trivy-operator-fips, headlamp, k8ssandra-client, chart-testing-fips, kubescape-server, cluster-api-helm-controller, cerbos-fips, chartmuseum, harbor, helm-mapkubeapis, helm-diff,...

CVE-2026-35172 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, portieris, envoy-gateway, zot, gitness, kots...

GHSA-3P65-76G6-3W7R vulnerabilities

Vulnerabilities for packages: argocd-image-updater, portieris, envoy-gateway, zot, gitness, kots...

GHSA-F2G3-HH2R-CWGC vulnerabilities

Vulnerabilities for packages: argocd-image-updater, portieris, envoy-gateway, zot, gitness, kots...

CVE-2026-33540 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, portieris, envoy-gateway, zot, gitness, kots...

CVE-2026-35172 vulnerabilities

Vulnerabilities for packages: envoy-gateway-fips, portieris, argocd-image-updater, portieris-fips, argocd-image-updater-fips, envoy-gateway, gitlab-rails-ce, gitlab-rails-ce-fips, gitness, kots, zot...

GHSA-3P65-76G6-3W7R vulnerabilities

Vulnerabilities for packages: envoy-gateway-fips, portieris, argocd-image-updater, portieris-fips, argocd-image-updater-fips, envoy-gateway, gitlab-rails-ce, gitlab-rails-ce-fips, gitness, kots, zot...

GHSA-F2G3-HH2R-CWGC vulnerabilities

Vulnerabilities for packages: envoy-gateway-fips, portieris, argocd-image-updater, portieris-fips, argocd-image-updater-fips, envoy-gateway, gitlab-rails-ce, gitlab-rails-ce-fips, gitness, kots, zot...

CVE-2026-33540 vulnerabilities

Vulnerabilities for packages: envoy-gateway-fips, portieris, argocd-image-updater, portieris-fips, argocd-image-updater-fips, envoy-gateway, gitlab-rails-ce, gitlab-rails-ce-fips, gitness, kots, zot...

The vulnerability of the EnvoyExtensionPolicy component of the software platform for managing Envoy Proxy Envoy Gateway allows a perpetrator to execute arbitrary code.

The vulnerability of the EnvoyExtensionPolicy component in the software platform for managing Envoy Proxy Envoy Gateway is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SUSE CVE-2026-22771

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

CVE-2026-22771

A flaw was found in Envoy Gateway. EnvoyExtensionPolicy Lua scripts, when executed by the Envoy proxy, can be exploited to leak the proxy's credentials. An attacker can then use these credentials to communicate with the control plane and gain unauthorized access to all secrets managed by the Envo...

BIT-ENVOY-GATEWAY-2026-22771 Envoy Extension Policy lua scripts injection causes arbitrary command execution

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

EUVD-2026-2007

Envoy Extension Policy lua scripts injection causes arbitrary command execution...

CVE-2026-22771

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...