Envoy Gateway Envoy ExtensionPolicy Lua leaks creds (before1.5.7/1.6.2)
CVE-2026-22771 Published on January 12, 2026
Envoy Extension Policy lua scripts injection causes arbitrary command execution
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.
Vulnerability Analysis
CVE-2026-22771 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2026-22771 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2026-22771
Want to know whenever a new CVE is published for Red Hat Connectivity Link? stack.watch will email you.
Affected Versions
envoyproxy gateway:- Version < 1.5.7 is affected.
- Version >= 1.6.0-rc.0, < 1.6.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.