Description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the "EnvoyProxy.spec.telemetry.accessLog" setting.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| envoyproxy | gateway | >= 1.3.0-rc.1, < 1.3.1, < 1.2.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250312T181707-1.1 | openSUSE-SU-2025:14889-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/envoyproxy/gateway | < 1.2.7 | 1.2.7 | GHSA-mf24-chxh-hmvj |
| Go | github.com/envoyproxy/gateway | >= 1.3.0-rc.1, < 1.3.1 | 1.3.1 | GHSA-mf24-chxh-hmvj |
| Go | github.com/envoyproxy/gateway | < 1.2.7 · >= 1.3.0-rc.1, < 1.3.1 | 1.2.7, 1.3.1 | GO-2025-3504 |
Advisories 1
- openSUSE-SU-2025:14889-1 govulncheck-vulndb-0.0.20250312T181707-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026