CVE-2024-45806: Envoyproxy Envoy Authentication Bypass

CVE-2024-45806 Overview

CVE-2024-45806 affects Envoy, a cloud-native high-performance edge, middle, and service proxy widely deployed in service meshes such as Istio. The vulnerability allows external clients to manipulate x-envoy-* headers because Envoy's default configuration treats all RFC1918 private address ranges as internal. Attackers reaching Envoy from a network path that appears to originate from private IP space can override trusted headers. Successful exploitation can bypass security controls, expose sensitive data, or disrupt mesh services. The issue has been fixed in Envoy versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7.

Critical Impact
External clients can spoof internal trust headers, enabling authorization bypass and unauthorized access to protected services within an Envoy-based mesh.

Affected Products

Envoy versions prior to 1.28.7
Envoy versions 1.29.0 through 1.29.8, 1.30.0 through 1.30.5, and 1.31.0 through 1.31.1
Service meshes built on affected Envoy releases, including Istio deployments

Discovery Timeline

2024-09-20 - CVE-2024-45806 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45806

Vulnerability Analysis

Envoy uses an internal trust boundary to decide whether to accept x-envoy-* headers from a client. Headers such as x-envoy-internal and x-envoy-original-path control routing, timeouts, and downstream identity propagation. When Envoy classifies a connection as internal, these headers are honored without sanitization. The proxy previously treated every RFC1918 address range as internal by default, even when internal_address_config was left empty. This design assumption breaks when Envoy is deployed behind load balancers, sidecars, or overlay networks where a client-controlled connection can present a private-range source address. The weakness maps to [CWE-639: Authorization Bypass Through User-Controlled Key].

Root Cause

The root cause is an insecure default configuration. Envoy's default trust policy substitutes a hardcoded RFC1918 allowlist for an explicit operator-defined internal network definition. Any request arriving with a source address in 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 is granted internal privileges, regardless of whether those ranges actually correspond to trusted infrastructure.

Attack Vector

An attacker sends HTTP requests to an Envoy listener from a network location that presents an RFC1918 source address. This includes cloud environments where Envoy sits behind a proxy that forwards traffic from arbitrary private ranges, or shared networks where an external tenant occupies private IP space. The attacker sets x-envoy-* headers directly on the request to influence routing, override the original path, or claim internal identity. Envoy accepts and forwards these headers to upstream services, which then trust them as originating from within the mesh.

No verified public proof-of-concept code is available. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2024-45806

Indicators of Compromise

Inbound HTTP requests containing x-envoy-internal, x-envoy-original-path, x-envoy-decorator-operation, or other x-envoy-* headers from clients outside the mesh
Access logs showing external requests with source IPs that resolve to RFC1918 ranges but originate from untrusted network segments
Unexpected upstream routing decisions or path rewrites that do not match documented service topology

Detection Strategies

Parse Envoy access logs for x-envoy-* request headers on listeners that accept external traffic and alert when they appear without an explicit trust chain
Correlate %DOWNSTREAM_REMOTE_ADDRESS% with expected internal CIDR ranges to identify address spoofing or forwarding misconfigurations
Baseline normal header sets per listener and flag deviations that indicate header injection attempts

Monitoring Recommendations

Forward Envoy access logs and mesh telemetry to a centralized log platform for correlation across proxies
Monitor upstream services for authorization decisions that were granted based on x-envoy-internal or forwarded identity headers
Track Envoy version inventory across clusters and alert on hosts still running versions prior to 1.28.7, 1.29.9, 1.30.6, or 1.31.2

How to Mitigate CVE-2024-45806

Immediate Actions Required

Upgrade Envoy to 1.31.2, 1.30.6, 1.29.9, or 1.28.7, whichever matches your deployed minor version
Explicitly define internal_address_config with the exact CIDR ranges of trusted probes, load balancers, and mesh components
Audit upstream services for reliance on x-envoy-* headers and remove any authorization logic that trusts them without independent verification

Patch Information

The Envoy project addressed CVE-2024-45806 in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. In the patched release, Envoy still trusts RFC1918 addresses by default but the maintainers announced this default will be removed in the following release. Operators must populate internal_address_config before that change to avoid breaking legitimate internal tooling. Full details are available in the GitHub Security Advisory GHSA-ffhv-fvxq-r6mf.

Workarounds

No workarounds are available according to the vendor advisory; upgrading and configuring internal_address_config explicitly is required
As a defense-in-depth measure, strip x-envoy-* headers at the edge listener for any traffic entering from untrusted network zones

bash

# Configuration example: explicitly define trusted internal CIDRs
# in the HttpConnectionManager internal_address_config
internal_address_config:
  cidr_ranges:
    - address_prefix: 10.20.0.0
      prefix_len: 16
    - address_prefix: 192.168.100.0
      prefix_len: 24