CVE-2026-22771

Summary: CVE-2026-22771 affects Envoy Gateway. Prior to versions 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by the Envoy proxy can leak credentials (e.g., TLS private keys and other secrets) used by the proxy, enabling access to control-plane secrets. The issue is described across...

CVE-2026-22771 Envoy Extension Policy lua scripts injection causes arbitrary command execution

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

CVE-2026-22771: Improper Control of Generation of Code

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

Envoy Gateway 代码注入漏洞

Envoy Gateway is an Envoy Proxy open source that uses the Envoy agent as a gateway for standalone or Kubernetes-based applications. A code injection vulnerability exists in Envoy Gateway versions prior to 1.5.7 and prior to 1.6.2 that stems from the EnvoyExtensionPolicy Lua script that could...

PT-2026-2290

Name of the Vulnerable Software and Affected Versions Envoy Gateway versions prior to 1.5.7 Envoy Gateway versions prior to 1.6.2 Description Envoy Gateway is an open source project for managing Envoy Proxy. EnvoyExtensionPolicy Lua scripts executed by the proxy can be used to leak the proxy's...

Envoy 安全漏洞

Envoy is an Enphase open source gateway program for connecting smart home devices. A security vulnerability exists in Envoy versions 1.33.12, 1.34.10, 1.35.6, 1.36.2, and prior versions, which stems from the mTLS certificate matcher incorrectly handling certificates embedded with null bytes, whic...

EUVD-2025-7667

Malicious code in bioql PyPI...

EUVD-2025-0174

Malicious code in bioql PyPI...

BIT-ENVOY-GATEWAY-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

BIT-ENVOY-GATEWAY-2025-24030 Envoy Admin Interface Exposed through prometheus metrics endpoint

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior...

GHSA-FV92-FJC5-JJ9H vulnerabilities

Vulnerabilities for packages: policy-controller, aws-iam-authenticator-fips, grafana-alloy-fips, tkn-fips, opentelemetry-collector, thanos-fips, tfsec, timestamp-authority-fips, grype, wgcf, nerdctl, kyverno-policy-reporter-ui, flux-source-controller-fips, opentelemetry-operator,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: flux-source-controller, dagger, flux-helm-controller, fuse-overlayfs-snapshotter, linkerd2, xeol, docker-compose, cluster-api-helm-controller, helm-operator, chartmuseum, docker, grype, skaffold, cert-manager-cmctl, kubevela, trivy, k8sgpt, cilium-cli, osv-scanner,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: k3s, helm-push, opa-envoy, envoy-gateway, rancher-fleet, opa, buildkitd, cilium-cli, linkerd2, rancher, docker-cli-buildx-fips, envoy-gateway-fips, zarf, beats-fips, cert-manager-cmctl, grype, helm-operator-fips, nerdctl, osv-scanner, flux-source-controller-fips,...

CVE-2024-40635 vulnerabilities

Vulnerabilities for packages: k3s, helm-push, opa-envoy, envoy-gateway, rancher-fleet, opa, buildkitd, cilium-cli, linkerd2, rancher, docker-cli-buildx-fips, envoy-gateway-fips, zarf, beats-fips, cert-manager-cmctl, grype, helm-operator-fips, nerdctl, osv-scanner, flux-source-controller-fips,...

SUSE CVE-2025-25294

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

Log Injection

Envoy Gateway is vulnerable to Log Injection. The vulnerability is due to improper log handling due to the use of a default Envoy Proxy access log configuration, allowing attackers to craft user-agent strings that inject and overwrite fields in the access log...

GO-2025-3504 Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway

Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway...

CVE-2025-25294

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

GHSA-MF24-CHXH-HMVJ Envoy Gateway Log Injection Vulnerability

Impact In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to th...

Envoy Gateway Log Injection Vulnerability

Impact In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to th...