Envoy Gateway Log Injection Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the "EnvoyProxy.spec.telemetry.accessLog" setting.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| envoyproxy | gateway | 1.3.0-rc.1 to before 1.3.1; before 1.2.7 | 1.3.1, 1.2.7 | Patch available | CNA |
| — | github.com/envoyproxy/gateway (Go) | before 1.2.7 | 1.2.7 | Patch available | GHSA-mf24-chxh-hmvj |
| — | github.com/envoyproxy/gateway (Go) | 1.3.0-rc.1 to before 1.3.1 | 1.3.1 | Patch available | GHSA-mf24-chxh-hmvj |
- gateway Vendorenvoyproxy Affected 1.3.0-rc.1 to before 1.3.1; before 1.2.7 Fixed in 1.3.1, 1.2.7 Patch available CNA
- github.com/envoyproxy/gateway (Go) Vendor— Affected before 1.2.7 Fixed in 1.2.7 Patch available GHSA-mf24-chxh-hmvj
- github.com/envoyproxy/gateway (Go) Vendor— Affected 1.3.0-rc.1 to before 1.3.1 Fixed in 1.3.1 Patch available GHSA-mf24-chxh-hmvj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:envoyproxy:gateway:*:*:*:*:*:*:*:* | before 1.2.7; 1.3.0 to before 1.3.1 | Vulnerable | envoyproxy |
- cpe:2.3:a:envoyproxy:gateway:*:*:*:*:*:*:*:* Versions before 1.2.7; 1.3.0 to before 1.3.1 Vulnerable ·envoyproxy
Remediation
- Fix · CNA gateway (envoyproxy) Fixed in 1.3.1, 1.2.7
- Fix · GHSA-mf24-chxh-hmvj github.com/envoyproxy/gateway (Go) Fixed in 1.2.7 Advisory →
- Fix · GHSA-mf24-chxh-hmvj github.com/envoyproxy/gateway (Go) Fixed in 1.3.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Connectivity Link 1 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-25294
- 2026-10-03 Alias added: GHSA-mf24-chxh-hmvj
References
Advisory 2
Other 6
- https://github.com/envoyproxy/gateway/commit/041d474a70d5921e5d65e6e14ea60e14dac70b01
- https://github.com/envoyproxy/gateway/commit/358bed50dcb7b32f39a2edb252fb1399c7fc65dc
- https://github.com/envoyproxy/gateway
- https://github.com/envoyproxy/gateway/releases/tag/v1.2.7
- https://github.com/envoyproxy/gateway/releases/tag/v1.3.1
- https://pkg.go.dev/vuln/GO-2025-3504
More envoyproxy Gateway vulnerabilities
- TI-2026-18289 Envoy Extension Policy lua scripts injection causes arbitrary command execution CVSS 3.1HIGH 8.8
- TI-2025-17797 Envoy Admin Interface Exposed through prometheus metrics endpoint CVSS 3.1HIGH 7.1
Sources
- CVE-2025-25294 · CVE Program
- CVE-2025-25294 · NVD
- FIRST EPSS
- GHSA-mf24-chxh-hmvj · GitHub Advisory Database · CC BY 4.0
- CVE-2025-25294 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences