CVE-2026-22771: Envoyproxy Gateway Info Disclosure Flaw

CVE-2026-22771 Overview

CVE-2026-22771 affects Envoy Gateway, an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. The vulnerability allows Lua scripts executed by Envoy proxy through an EnvoyExtensionPolicy to leak the proxy's credentials. Attackers who obtain these credentials can communicate with the control plane and retrieve all secrets used by Envoy proxy, including TLS private keys and credentials used for downstream and upstream communication. The flaw is tracked under CWE-94: Improper Control of Generation of Code. Envoy Gateway versions prior to 1.5.7 and 1.6.2 are affected.

Critical Impact
A tenant or user able to define an EnvoyExtensionPolicy Lua script can exfiltrate proxy credentials and pivot to the control plane, exposing every TLS key and secret managed by Envoy Gateway.

Affected Products

Envoy Gateway versions prior to 1.5.7
Envoy Gateway versions prior to 1.6.2 in the 1.6.x branch
Deployments using EnvoyExtensionPolicy with Lua scripting enabled

Discovery Timeline

2026-01-12 - CVE-2026-22771 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-22771

Vulnerability Analysis

Envoy Gateway exposes the EnvoyExtensionPolicy resource, which lets operators attach Lua scripts to traffic flows handled by Envoy proxy. The Lua execution context runs inside the proxy data plane and has access to runtime state that includes credentials the proxy uses to authenticate to the Envoy Gateway control plane. A user permitted to author or modify an EnvoyExtensionPolicy can read those credentials from within Lua and exfiltrate them through an outbound HTTP call or response header manipulation.

With the proxy's credentials, an attacker authenticates to the control plane API and retrieves every secret the gateway distributes. This includes TLS private keys for downstream listeners and upstream client certificates, mTLS material, and any other credentials referenced by configured routes. The result is full compromise of all traffic protected by the gateway across tenants sharing the same control plane.

Root Cause

The root cause is excessive trust placed in the Lua extension sandbox. Proxy-level credentials were reachable from script context instead of being isolated to the bootstrap or xDS client layer. Combined with an authorization model that allowed policy authors to indirectly inherit the proxy's identity, this enabled credential theft through legitimate EnvoyExtensionPolicy configuration.

Attack Vector

Exploitation requires the attacker to hold privileges to create or modify an EnvoyExtensionPolicy in the cluster, which corresponds to a low-privileged authenticated tenant in many multi-tenant Envoy Gateway deployments. The attacker authors a Lua script that reads proxy credentials and transmits them to an attacker-controlled endpoint. Once credentials are captured, the attacker queries the control plane directly to dump all secrets. No user interaction is required and the attack is fully network-based. See the GitHub Security Advisory GHSA-xrwg-mqj6-6m22 for the maintainer's technical write-up.

Detection Methods for CVE-2026-22771

Indicators of Compromise

Unexpected outbound HTTP or DNS traffic originating from Envoy proxy pods to non-corporate destinations shortly after an EnvoyExtensionPolicy change.
EnvoyExtensionPolicy resources containing Lua code that references environment variables, mounted token paths, or HTTP client libraries.
Control plane API requests authenticated as the data plane proxy identity from unusual source IPs or at atypical times.

Detection Strategies

Audit all EnvoyExtensionPolicy resources in every namespace for inline Lua blocks and review them for filesystem, network, or environment access.
Correlate Kubernetes audit logs for envoyextensionpolicies create or update events with subsequent egress from the affected Envoy pod.
Alert on control plane authentication events that originate outside the cluster network or that retrieve large numbers of secret references in a short window.

Monitoring Recommendations

Enable Kubernetes audit logging at RequestResponse level for the gateway.envoyproxy.io API group and forward logs to a central analytics platform.
Baseline egress traffic from gateway data plane pods and alert on new destinations or anomalous request volumes.
Monitor control plane secret read operations and flag bursts of Secret API access by data plane service accounts.

How to Mitigate CVE-2026-22771

Immediate Actions Required

Upgrade Envoy Gateway to 1.5.7 or 1.6.2 as published in GHSA-xrwg-mqj6-6m22.
Rotate all TLS private keys, client certificates, and upstream credentials referenced by the gateway, assuming prior compromise where Lua policies were used.
Review RBAC for the EnvoyExtensionPolicy resource and restrict write access to a small set of trusted operators.

Patch Information

The vulnerability is fixed in Envoy Gateway 1.5.7 and 1.6.2. Operators running any earlier release in either branch must upgrade. Refer to the Envoy Gateway GitHub Security Advisory for release notes and upgrade guidance.

Workarounds

Disable or remove all EnvoyExtensionPolicy resources that include Lua scripts until the upgrade is complete.
Restrict the Kubernetes RBAC verbs create, update, and patch on envoyextensionpolicies.gateway.envoyproxy.io to cluster administrators only.
Apply network policies that block egress from gateway data plane pods to destinations outside the expected upstream service set.

bash

# Example RBAC restriction limiting EnvoyExtensionPolicy modification to admins
kubectl create clusterrole envoy-ext-policy-readonly \
  --verb=get,list,watch \
  --resource=envoyextensionpolicies.gateway.envoyproxy.io

kubectl create clusterrolebinding envoy-ext-policy-readonly \
  --clusterrole=envoy-ext-policy-readonly \
  --group=system:authenticated