PT-2026-2290 · Unknown · Envoy Gateway

Guydc + 1 · Publicado 2026-01-12 · Atualizado 2026-01-26 · CVE-2026-22771

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Envoy Gateway versions prior to 1.5.7 Envoy Gateway versions prior to 1.6.2

Description Envoy Gateway is an open source project for managing Envoy Proxy. EnvoyExtensionPolicy Lua scripts executed by the proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to secrets used by Envoy proxy, such as TLS private keys and credentials used for upstream and downstream communication.

Recommendations Update Envoy Gateway to version 1.5.7 or later. Update Envoy Gateway to version 1.6.2 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2026-01040

BIT-ENVOY-GATEWAY-2026-22771

CVE-2026-22771

GHSA-XRWG-MQJ6-6M22

GO-2026-4312

SUSE-SU-2026:0292-1

Produtos afetados

Envoy Gateway

Referências · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22771.json · Exploit
• https://github.com/envoyproxy/gateway/security/advisories/GHSA-xrwg-mqj6-6m22 · Aviso do Fabricante
• https://github.com/envoyproxy/gateway · Nota
• https://bdu.fstec.ru/vul/2026-01040 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xrwg-mqj6-6m22 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-68388 · Nota
• https://suse.com/security/cve/CVE-2026-23511 · Nota
• https://suse.com/security/cve/CVE-2024-44905 · Nota
• https://twitter.com/TheHackerWire/status/2010804109637812335 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2017-18892 · Nota
• https://suse.com/security/cve/CVE-2026-22868 · Nota
• https://suse.com/security/cve/CVE-2026-23520 · Nota
• https://suse.com/security/cve/CVE-2025-68383 · Nota
• https://osv.dev/vulnerability/BIT-envoy-gateway-2026-22771 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-22772 · Nota