CVE-2025-24030highCWE-419

CVE-2025-24030: fallo de gravedad alta en envoyproxy gateway

Envoy Admin Interface Exposed through prometheus metrics endpoint

Publicada el

Seguir esta CVE+ Monitorear gateway+ Monitorear github.com/envoyproxy/gateway

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.4%
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Productos afectados
envoyproxy · gateway
CVEs relacionadas — envoyproxy gateway

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-53716MEDIUMEnvoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitEPSS 0.7%CVE-2026-53719MEDIUMEnvoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorizationEPSS 0.7%CVE-2026-53717MEDIUMEnvoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerEPSS 0.7%CVE-2026-22771HIGHEnvoy Extension Policy lua scripts injection causes arbitrary command executionEPSS 0.6%CVE-2026-53715MEDIUMEnvoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockEPSS 0.5%CVE-2026-53713CRITICALEnvoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret DisclosureEPSS 0.4%