Path Traversal Vulnerability in Envoy Gateway by EnvoyProxy

CVE-2025-24030

What is CVE-2025-24030?

A path traversal vulnerability has been identified in Envoy Gateway, which is designed for managing Envoy Proxy in standalone or Kubernetes environments. This issue allows a user with access to the Kubernetes cluster to exploit the Envoy Admin interface via a path traversal attack, which can result in unauthorized command execution on the proxies managed by the affected version of Envoy Gateway. An attacker could potentially terminate the Envoy process and extract configuration details, including sensitive information. The vulnerability is addressed in version 1.2.6, with mitigation strategies suggesting the use of bootstrap config patches to limit access to essential endpoints only.

References