CVE-2025-24030: envoyproxy gateway Unprotected Primary Channel

Vulnerability summary

CVE-2025-24030 is a high (CVSS 7.1) Unprotected Primary Channel vulnerability in envoyproxy gateway. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.1% of scored vulnerabilities.

Timeline

1. 23-01-2025
   PublishedVulnerability first disclosed.
2. 23-01-2025
   Last modifiedVulnerability information updated.

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.

• CWE-419Unprotected Primary ChannelThe product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.