Credential Exposure in Envoy Gateway by Envoy Proxy Lua Scripts
CVE-2026-22771

8.8HIGH

Key Information:

Vendor

Envoyproxy

Status
Gateway
Vendor
CVE Published:
12 January 2026

What is CVE-2026-22771?

Envoy Gateway, an open source project designed for managing Envoy Proxy, has a vulnerability that permits unauthorized access to sensitive proxy credentials. Specifically, Lua scripts executing within Envoy prior to versions 1.5.7 and 1.6.2 can potentially expose TLS private keys and other credentials used in both downstream and upstream communications. This leakage enables malicious entities to communicate with the control plane, effectively allowing them access to all secrets managed by the proxy. Users are advised to update their installations to the patched versions to mitigate this risk.

Affected Version(s)

gateway < 1.5.7 < 1.5.7

gateway >= 1.6.0-rc.0, < 1.6.2 < 1.6.0-rc.0, 1.6.2

References

https://github.com/envoyproxy/gateway/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.