CVE-2026-22771

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22771", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T18:27:19.387Z", "datePublished": "2026-01-12T18:08:22.532Z", "dateUpdated": "2026-07-15T01:19:24.781Z"}, "containers": {"cna": {"title": "Envoy Extension Policy lua scripts injection causes arbitrary command execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-xrwg-mqj6-6m22", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-xrwg-mqj6-6m22"}], "affected": [{"vendor": "envoyproxy", "product": "gateway", "versions": [{"version": "< 1.5.7", "status": "affected"}, {"version": ">= 1.6.0-rc.0, < 1.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T18:08:22.532Z"}, "descriptions": [{"lang": "en", "value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2."}], "source": {"advisory": "GHSA-xrwg-mqj6-6m22", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T18:49:10.805589Z", "id": "CVE-2026-22771", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:49:19.868Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:connectivity_link:1"], "defaultStatus": "unaffected", "packageName": "rhcl-1/rhcl-operator-bundle", "product": "Red Hat Connectivity Link 1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:connectivity_link:1"], "defaultStatus": "unaffected", "packageName": "rhcl-1/rhcl-rhel9-operator", "product": "Red Hat Connectivity Link 1", "vendor": "Red Hat"}], "datePublic": "2026-01-12T18:08:22.532Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Envoy Gateway. EnvoyExtensionPolicy Lua scripts, when executed by the Envoy proxy, can be exploited to leak the proxy's credentials. An attacker can then use these credentials to communicate with the control plane and gain unauthorized access to all secrets managed by the Envoy proxy, including sensitive TLS private keys. This vulnerability leads to critical information disclosure, potentially compromising the security of communications."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-22771"}, {"name": "RHBZ#2428735", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428735"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22771.json"}], "timeline": [{"lang": "en", "time": "2026-01-12T19:01:29.001Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-12T18:08:22.532Z", "value": "Made public."}], "title": "envoyproxy/gateway: Envoy Gateway: Unauthorized access to secrets via Lua script credential leakage", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:19:24.781Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "envoyproxy/gateway: Envoy Gateway: Unauthorized access to secrets via Lua script credential leakage", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:connectivity_link:1"], "vendor": "Red Hat", "product": "Red Hat Connectivity Link 1", "packageName": "rhcl-1/rhcl-operator-bundle", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:connectivity_link:1"], "vendor": "Red Hat", "product": "Red Hat Connectivity Link 1", "packageName": "rhcl-1/rhcl-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-12T19:01:29.001Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-12T18:08:22.532Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-01-12T18:08:22.532Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-22771", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428735", "name": "RHBZ#2428735", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22771.json", "tags": ["x_sadp-csaf-vex"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Envoy Gateway. EnvoyExtensionPolicy Lua scripts, when executed by the Envoy proxy, can be exploited to leak the proxy's credentials. An attacker can then use these credentials to communicate with the control plane and gain unauthorized access to all secrets managed by the Envoy proxy, including sensitive TLS private keys. This vulnerability leads to critical information disclosure, potentially compromising the security of communications."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:19:24.781Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22771", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-12T18:49:10.805589Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:49:15.888Z"}}], "cna": {"title": "Envoy Extension Policy lua scripts injection causes arbitrary command execution", "source": {"advisory": "GHSA-xrwg-mqj6-6m22", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "envoyproxy", "product": "gateway", "versions": [{"status": "affected", "version": "< 1.5.7"}, {"status": "affected", "version": ">= 1.6.0-rc.0, < 1.6.2"}]}], "references": [{"url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-xrwg-mqj6-6m22", "name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-xrwg-mqj6-6m22", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T18:08:22.532Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22771", "state": "PUBLISHED", "dateUpdated": "2026-07-15T01:19:24.781Z", "dateReserved": "2026-01-09T18:27:19.387Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T18:08:22.532Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gateway", "vendor": "envoyproxy", "versions": [{"status": "affected", "version": "< 1.5.7"}, {"status": "affected", "version": ">= 1.6.0-rc.0, < 1.6.2"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:connectivity_link:1"], "defaultStatus": "unaffected", "packageName": "rhcl-1/rhcl-operator-bundle", "product": "Red Hat Connectivity Link 1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:connectivity_link:1"], "defaultStatus": "unaffected", "packageName": "rhcl-1/rhcl-rhel9-operator", "product": "Red Hat Connectivity Link 1", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2A97BD9-F262-4D47-8C04-D4470FB7814A", "versionEndExcluding": "1.5.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "F023F702-BA4E-4DD9-B7EE-31F221F632E0", "versionEndExcluding": "1.6.2", "versionStartIncluding": "1.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2."}, {"lang": "es", "value": "Envoy Gateway es un proyecto de c\u00f3digo abierto para gestionar Envoy Proxy como una pasarela de aplicaciones independiente o basada en Kubernetes. Antes de las versiones 1.5.7 y 1.6.2, los scripts Lua de EnvoyExtensionPolicy ejecutados por el proxy Envoy pueden ser utilizados para filtrar las credenciales del proxy. Estas credenciales pueden entonces ser utilizadas para comunicarse con el plano de control y obtener acceso a todos los secretos que son utilizados por el proxy Envoy, por ejemplo, claves privadas TLS y credenciales utilizadas para la comunicaci\u00f3n descendente y ascendente. Esta vulnerabilidad est\u00e1 corregida en las versiones 1.5.7 y 1.6.2."}], "id": "CVE-2026-22771", "lastModified": "2026-07-15T02:18:35.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22771", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T18:49:10.805589Z", "version": "2.0.3"}}]}, "published": "2026-01-12T19:16:03.470", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-xrwg-mqj6-6m22"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-22771"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428735"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22771.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-94"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "envoyproxy/gateway: Envoy Gateway: Unauthorized access to secrets via Lua script credential leakage", "id": "2428735", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428735"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.", "A flaw was found in Envoy Gateway. EnvoyExtensionPolicy Lua scripts, when executed by the Envoy proxy, can be exploited to leak the proxy's credentials. An attacker can then use these credentials to communicate with the control plane and gain unauthorized access to all secrets managed by the Envoy proxy, including sensitive TLS private keys. This vulnerability leads to critical information disclosure, potentially compromising the security of communications."], "name": "CVE-2026-22771", "package_state": [{"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Not affected", "package_name": "rhcl-1/rhcl-operator-bundle", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Not affected", "package_name": "rhcl-1/rhcl-rhel9-operator", "product_name": "Red Hat Connectivity Link 1"}], "public_date": "2026-01-12T18:08:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-22771\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22771\nhttps://github.com/envoyproxy/gateway/security/advisories/GHSA-xrwg-mqj6-6m22"], "statement": "Red Hat products do not contain the affected components.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-18T07:00:19.278426+00:00", "value": {"mitigation_remediation": ["Upgrade Envoy Gateway to version 1.5.7 or later 1.6.2, which contains the fix for the Lua script injection flaw.", "If an upgrade cannot be performed immediately, remove or disable all custom Lua policies and isolate the policy execution environment to prevent unauthorized script execution.", "As a temporary measure, restrict or block access to the Envoy control plane from untrusted sources to stop the use of leaked credentials."], "summary": {"action": "Patch immediately", "impact": "Credential leakage and secret disclosure via Lua script injection"}, "threat_synthesis": {"affected_systems": "Envoy Gateway versions before 1.5.7 for the 1.5.x branch and before 1.6.2 for the 1.6.x branch are affected. All deployments using those versions that allow custom Lua policies are at risk. The issue is fixed in 1.5.7 and 1.6.2 and later releases.", "description_and_impact": "The vulnerability is a code injection flaw in Envoy Gateway\u2019s Lua policy handler. By supplying a malicious Lua script through an EnvoyExtensionPolicy, an attacker can have the script executed with Envoy\u2019s privileges, enabling the extraction of the proxy\u2019s internal credentials. Those credentials can then be used to communicate with the control plane and access all secrets stored by Envoy, such as TLS private keys and downstream/upstream communication credentials. The weakness is identified as CWE\u201194.", "risk_and_exploitability": "The CVSS score of 8.8 denotes high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog at this time. Exploitation requires control over the Lua policy configuration, which is typically available to operators or anyone able to inject a policy. If such access exists, the attacker can immediately extract credentials and consequently compromise all secrets used by the Envoy instance."}}}}, "created": "2026-01-13T09:27:08.400266+00:00", "updated": "2026-04-18T07:15:25.843563+00:00", "vendors": ["envoyproxy", "envoyproxy$PRODUCT$gateway"]}