CVE-2026-22771: high-severity vulnerability in envoyproxy gateway
Envoy Extension Policy lua scripts injection causes arbitrary command execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.6%
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
envoyproxy · gatewayRelated CVEs — envoyproxy gateway
In the same product, most dangerous first.
CVE-2026-53716MEDIUMEnvoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitEPSS 0.7%CVE-2026-53719MEDIUMEnvoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorizationEPSS 0.7%CVE-2026-53717MEDIUMEnvoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerEPSS 0.7%CVE-2026-53715MEDIUMEnvoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockEPSS 0.5%CVE-2026-53713CRITICALEnvoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret DisclosureEPSS 0.4%CVE-2025-24030HIGHEnvoy Admin Interface Exposed through prometheus metrics endpointEPSS 0.4%