CVE-2025-24030

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-419

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-240315.1PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 modul CVE-2025-240329.2PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to CVE-2025-240337.5@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` fun CVE-2025-240343.2Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and CVE-2025-240358.1Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a CVE-2025-240367.0Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability CVE-2025-240397.3Visual Studio Code Elevation of Privilege Vulnerability CVE-2025-24044.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies S CVE-2025-240427.3Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability CVE-2025-240437.5Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network.CVE-2025-240447.8Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.CVE-2025-240458.1Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a