Executive brief
Envoy Gateway is an open-source tool used to manage network traffic in Kubernetes environments. A security flaw allows users with permission to create Lua scripts to steal sensitive credentials from the system. An attacker could use these stolen credentials to gain full access to private encryption keys and other confidential data, potentially leading to a complete takeover of the gateway infrastructure.
Technical details
A code injection vulnerability exists in Envoy Gateway's EnvoyExtensionPolicy resource, where Lua scripts are executed by the Envoy proxy and the Gateway controller. An attacker with low privileges (sufficient to create or modify these policies) can craft a Lua script to read sensitive files from the local filesystem, such as XDS client certificates or Kubernetes service account tokens. These leaked credentials can be used to authenticate with the control plane, allowing the attacker to retrieve all secrets managed by the proxy (including TLS private keys) or achieve privilege escalation within the Kubernetes cluster. The issue is addressed in versions 1.5.7 and 1.6.2 by implementing a security hardening module that blocks dangerous Lua functions and introducing a 'disableLua' option.
Affected products
- Envoy Proxy Gateway < 1.5.7, >= 1.6.0-rc.0 < 1.6.2
- Red Hat Connectivity Link 1 1
Timeline
- 2026-01-12: disclosed
- 2026-01-12: advisory
- 2026-01-12: patched