PT-2026-2290 · Unknown · Envoy Gateway

Guydc + 1 · Published 2026-01-12 · Updated 2026-01-26 · CVE-2026-22771

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Envoy Gateway versions prior to 1.5.7 Envoy Gateway versions prior to 1.6.2

Description Envoy Gateway is an open source project for managing Envoy Proxy. EnvoyExtensionPolicy Lua scripts executed by the proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to secrets used by Envoy proxy, such as TLS private keys and credentials used for upstream and downstream communication.

Recommendations Update Envoy Gateway to version 1.5.7 or later. Update Envoy Gateway to version 1.6.2 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-01040

BIT-ENVOY-GATEWAY-2026-22771

CVE-2026-22771

GHSA-XRWG-MQJ6-6M22

GO-2026-4312

SUSE-SU-2026:0292-1

Affected Products

Envoy Gateway

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22771.json · Exploit
• https://github.com/envoyproxy/gateway/security/advisories/GHSA-xrwg-mqj6-6m22 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01040 · Security Note
• https://osv.dev/vulnerability/GHSA-xrwg-mqj6-6m22 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-gateway-2026-22771 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22771 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22771 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0292-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4312 · Vendor Advisory
• https://github.com/envoyproxy/gateway · Note
• https://suse.com/security/cve/CVE-2025-68388 · Note
• https://suse.com/security/cve/CVE-2026-23511 · Note
• https://suse.com/security/cve/CVE-2024-44905 · Note
• https://twitter.com/TheHackerWire/status/2010804109637812335 · Twitter Post
• https://suse.com/security/cve/CVE-2017-18892 · Note