https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:34:21 +0000 https://cve.radiocsirt.org/vuln/cve-2026-22771 <p><strong>Affected:</strong> envoyproxy gateway, Red Hat Connectivity Link 1</p> <p>Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy&#39;s credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.</p> <p><strong>Affected:</strong> envoyproxy gateway, Red Hat Connectivity Link 1</p> <p>Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy&#39;s credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-22771 https://cve.radiocsirt.org/vuln/ghsa-22xc-xg2r-9j7v <p><strong>Affected:</strong> Go: github.com/envoyproxy/gateway</p> <p>### Impact When Envoy Gateway runs in GatewayNamespaceMode (`provider.kubernetes.deploy.type=GatewayNamespace`), the xDS gRPC server is configured with a `StreamInterceptor` for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary (Fetch) RPC methods for all registered discovery services. Since there is no unary interceptor, these Fetch endpoints are completely unauthenticated.</p> <p>Additionally, the JWT authentication interceptor in GatewayNamespaceMode only validates tokens when the received gRPC message is of type `discoveryv3.DeltaDiscoveryRequest` . If the message is a `discoveryv3.DiscoveryRequest` — used by the State-of-the-World (SotW) xDS protocol — the type assertion fails, the validation block is skipped entirely, and RecvMsg returns nil (success) without any authentication.</p> <p>Any pod in the cluster that can reach the xDS server (port 18000) can use the SotW protocol to bypass JWT authentication and access:</p> <p>* TLS private keys via StreamSecrets (SDS) * All xDS resources via StreamAggregatedResources (ADS) * Backend endpoints via StreamClusters / StreamEndpoints (CDS/EDS) * Routing rules via StreamRoutes / StreamListeners (RDS/LDS)</p> <p>### Credits</p> <p>Envoy Gateway thanks @dashingDragon and @Donjon-Cerberus for reporting this issue.</p> <p><strong>Affected:</strong> Go: github.com/envoyproxy/gateway</p> <p>### Impact When Envoy Gateway runs in GatewayNamespaceMode (`provider.kubernetes.deploy.type=GatewayNamespace`), the xDS gRPC server is configured with a `StreamInterceptor` for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary (Fetch) RPC methods for all registered discovery services. Since there is no unary interceptor, these Fetch endpoints are completely unauthenticated.</p> <p>Additionally, the JWT authentication interceptor in GatewayNamespaceMode only validates tokens when the received gRPC message is of type `discoveryv3.DeltaDiscoveryRequest` . If the message is a `discoveryv3.DiscoveryRequest` — used by the State-of-the-World (SotW) xDS protocol — the type assertion fails, the validation block is skipped entirely, and RecvMsg returns nil (success) without any authentication.</p> <p>Any pod in the cluster that can reach the xDS server (port 18000) can use the SotW protocol to bypass JWT authentication and access:</p> <p>* TLS private keys via StreamSecrets (SDS) * All xDS resources via StreamAggregatedResources (ADS) * Backend endpoints via StreamClusters / StreamEndpoints (CDS/EDS) * Routing rules via StreamRoutes / StreamListeners (RDS/LDS)</p> <p>### Credits</p> <p>Envoy Gateway thanks @dashingDragon and @Donjon-Cerberus for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-22xc-xg2r-9j7v