← Vulnerability feed

Vulnerability record · CVE-2025-24030 · published 23 January 2025

CVE-2025-24030: Envoyproxy gateway vulnerability

Envoyproxy · Gateway

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.

7.1 CVSS 3.1 High EPSS 0.42% · top 66.0% CWE-419 · CWE-419
7.1CVSS 3.1 base score
0.42%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/envoyproxy/gateway/commit/3eb3301ab3dbf12b201b47bdb6074d1233be07bd Patch
https://github.com/envoyproxy/gateway/security/advisories/GHSA-j777-63hf-hx76 MitigationThird Party Advisory
https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge Product
https://www.envoyproxy.io/docs/envoy/latest/operations/admin Product

Track CVE-2025-24030 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-22771Envoyproxy gateway code injection vulnerabilityEnvoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, E…EPSS 0.63%5.3CVE-2025-25294Envoyproxy gateway vulnerabilityEnvoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versio…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2025-24030), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.