Skip to content
OpenAdvisories

Vendor

envoyproxy

108 known vulnerabilities.

Products

envoy 98 gateway 10
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-53713

    Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

    Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separa…

    envoyproxy gateway github.com/envoyproxy/gateway Go
  • Critical 10.0
    CVE-2022-29226

    Trivial authentication bypass in Envoy

    Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be tri…

    envoyproxy envoy