High severity · published Jan 12, 2026
CVE-2026-22771
Envoy Extension Policy lua scripts injection causes arbitrary command execution
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
gateway · envoyproxy
< 1.5.7; >= 1.6.0-rc.0, < 1.6.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22771
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22771
Exploit
https://github.com/envoyproxy/gateway/security/advisories/GHSA-xrwg-mqj6-6m22
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-22771
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2428735
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22771.json
More from gateway
9.1
CVE-2026-53713
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
7.4
CVE-2026-53714
Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
7.1
CVE-2025-24030
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
6.5
CVE-2026-53716
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
6.5
CVE-2026-53719
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization