CVE-2026-22771

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-22771
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22771.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-22771
Aliases
  • GHSA-xrwg-mqj6-6m22
Published
2026-01-12T18:08:22.532Z
Modified
2026-01-12T19:56:21.583894Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Envoy Extension Policy lua scripts injection causes arbitrary command execution
Details

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22771.json",
    "cwe_ids": [
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/envoyproxy/gateway

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/gateway
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
690f3fa5de6ffae7a21ab648381bee01b299da1f
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/envoyproxy/gateway
Events
Introduced
ee4ae715856ca31c67c6cb5e8a421c539f04147e
Fixed
27bf1cc2cde456449c995f360832b3cd2fd29c7c
Database specific 
{
    "versions": [
        {
            "introduced": "1.6.0-rc.0"
        },
        {
            "fixed": "1.6.2"
        }
    ]
}

Affected versions

Other

latest

v0.*

v0.1.0
v0.2.0
v0.2.0-rc1
v0.2.0-rc2
v0.5.0-rc.1

v1.*

v1.5.0
v1.5.0-rc.1
v1.5.0-rc.2
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.6.0
v1.6.0-rc.0
v1.6.0-rc.1
v1.6.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22771.json"