Is CVE-2026-22771 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22771 being exploited in the wild.

How severe is CVE-2026-22771?

High severity, with a CVSS score of 8.8, published 12 January 2026.

Which products and versions are affected?

github.com/envoyproxy/gateway (Go) SEMVER:introduced=0,fixed=1.5.7,introduced=1.6.0-rc.0,fixed=1.6.2, SEMVER:introduced=1.6.0-rc.0,fixed=1.6.2; Red Hat Connectivity Link 1.

Is there a fix for CVE-2026-22771?

Yes. github.com/envoyproxy/gateway (Go): upgrade to 1.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22771 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-22771?

Check whether you run github.com/envoyproxy/gateway (Go) or Red Hat Connectivity Link at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22771: Envoy Gateway code injection via EnvoyExtensionPolicy Lua scripts

CVE-2026-22771 · Severity: high · CVSS 8.8 · Published 2026-01-12

Envoy Gateway is an open-source tool used to manage network traffic in Kubernetes environments. A security flaw allows users with permission to create Lua scripts to steal sensitive credentials from the system. An attacker could use these stolen credentials to gain full access to private encryption keys and other confidential data, potentially leading to a complete takeover of the gateway infrastructure.

Technologies: github.com/envoyproxy/gateway (Go), Red Hat Connectivity Link. Vendors: Go, Red Hat.

Quick answers

Is CVE-2026-22771 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22771 being exploited in the wild.
How severe is CVE-2026-22771?: High severity, with a CVSS score of 8.8, published 12 January 2026.
Which products and versions are affected?: github.com/envoyproxy/gateway (Go) SEMVER:introduced=0,fixed=1.5.7,introduced=1.6.0-rc.0,fixed=1.6.2, SEMVER:introduced=1.6.0-rc.0,fixed=1.6.2; Red Hat Connectivity Link 1.
Is there a fix for CVE-2026-22771?: Yes. github.com/envoyproxy/gateway (Go): upgrade to 1.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22771 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-22771?: Check whether you run github.com/envoyproxy/gateway (Go) or Red Hat Connectivity Link at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/envoyproxy/gateway (Go): upgrade to 1.6.2 or later
```
go get github.com/envoyproxy/gateway@v1.6.2
```

Technical details

A code injection vulnerability exists in Envoy Gateway's EnvoyExtensionPolicy resource, where Lua scripts are executed by the Envoy proxy and the Gateway controller. An attacker with low privileges (sufficient to create or modify these policies) can craft a Lua script to read sensitive files from the local filesystem, such as XDS client certificates or Kubernetes service account tokens. These leaked credentials can be used to authenticate with the control plane, allowing the attacker to retrieve all secrets managed by the proxy (including TLS private keys) or achieve privilege escalation within the Kubernetes cluster. The issue is addressed in versions 1.5.7 and 1.6.2 by implementing a security hardening module that blocks dangerous Lua functions and introducing a 'disableLua' option.

Affected products

Envoy Proxy Gateway < 1.5.7, >= 1.6.0-rc.0 < 1.6.2
Red Hat Connectivity Link 1 1

Identifiers

CVE-2026-22771
GHSA-xrwg-mqj6-6m22
GO-2026-4312

Timeline

2026-01-12: disclosed
2026-01-12: advisory
2026-01-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.