CVE-2026-22771: envoyproxy gateway

csirt@kutim:~/threat-intel/cve/CVE-2026-22771

CVSS 8.8 · High EPSS 0,62%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada envoyproxy gateway. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.

Rincian

Terbit di NVD: 12 Januari 2026
Terakhir diubah: 15 Juli 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari): 0,62% peluang dieksploitasi; lebih tinggi dari 48,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
envoyproxy	gateway	Semua versi sebelum 1.5.7
envoyproxy	gateway	Versi 1.6.0 hingga sebelum 1.6.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.