Skip to content
OpenAdvisories
Medium WID-SEC-2026-0704 7 CVEs

Google Cloud Platform Envoy Proxy, Istio und Service Mesh: Mehrere Schwachstellen

Published Mar 11, 2026 · Updated Apr 1, 2026 · Revision 3 · de-DE

Vendor: amazon Vendor: Google Vendor: Red Hat Product: Cloud Platform Product: Enterprise Linux Product: Linux 2 Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Google Cloud Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Google Cloud Platform (GCP) ist eine Sammlung von Cloud-Computing-Diensten von Google, die Infrastruktur, Datenanalyse, maschinelles Lernen und Entwicklungstools bietet. Unternehmen können dadurch Anwendungen in der Cloud zu aufbauen und skalierbar bereitzustellen.

Vulnerabilities 7

  • High 8.7
    CVE-2026-31837

    Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.

    Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestA…

    istio istio
  • High 7.5
    CVE-2026-26308

    Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the sam…

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 6.9
    CVE-2026-31838

    Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.

    Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a vulnerability in Envoy RBAC header matching could allow authorization policy bypass when policies rely on HTTP headers that may contain multiple val…

    istio istio
  • Medium 5.9
    CVE-2026-26310

    Crash for scoped ip address in Envoy during DNS

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the…

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 5.9
    CVE-2026-26311

    Envoy HTTP: filter chain execution on reset streams causing UAF crash

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream Filter Execution. This issue creates a "Use-After-Free"…

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 5.3
    CVE-2026-26309

    Envoy has an off-by-one write in JsonEscaper::escapeString()

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing undefined behavior and potentially leading to cras…

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 5.3
    CVE-2026-26330

    Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with apply_on_stream_done in the rate limit configuration is enabled and the response phase limit reques…

    envoyproxy envoy github.com/envoyproxy/envoy Go

Revision history

  1. #3

    Neue Updates von Amazon aufgenommen

  2. #2

    Neue Updates von Red Hat aufgenommen

  3. #1

    Initiale Fassung

References