Bug 2428735 (CVE-2026-22771) - CVE-2026-22771 envoyproxy/gateway: Envoy Gateway: Unauthorized access to secrets via Lua script credential leakage
Summary: CVE-2026-22771 envoyproxy/gateway: Envoy Gateway: Unauthorized access to secr...
Keywords:
Status: NEW
Alias: CVE-2026-22771
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-12 19:02 UTC by OSIDB Bzimport
Modified: 2026-01-15 17:01 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-01-12 19:02:40 UTC 
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.
Note You need to log in before you can comment on or make changes to this bug.