Vulnerabilities

TI-2026-18289 CVE-2026-22771 · GHSA-xrwg-mqj6-6m22

Envoy Extension Policy lua scripts injection causes arbitrary command execution

MEDIUM 47

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00622 Published 2026-01-12 Fixed in 1.5.7, 1.6.2 CWE-94

TI-2025-18948 CVE-2025-25294 · GHSA-mf24-chxh-hmvj

LOW 30

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00286 Published 2025-03-06 Partial fix · 1.3.1, 1.2.7 CWE-117

TI-2025-17797 CVE-2025-24030 · GHSA-j777-63hf-hx76

LOW 32

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway.

CVSS 3.1HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00419 Published 2025-01-23 Partial fix · 1.2.6 CWE-419