Envoy Gateway Vulnerability Disclosure

specification: API Commons Vulnerability Disclosure
specificationVersion: '0.1'
provider: Envoy Gateway
providerId: envoy-gateway
generated: '2026-09-07'
method: searched
source: >-
  https://github.com/envoyproxy/gateway/blob/main/SECURITY.md (HTTP 200, fetched
  2026-09-07), corroborated by the security-updates sections of the v1.9.0 and v1.9.1
  release notes and by the published advisories at
  https://github.com/envoyproxy/gateway/security/advisories.
description: >-
  Envoy Gateway runs a real coordinated-disclosure programme with a named private mailbox,
  a stated response target, a stated maximum embargo, CVE assignment, and a documented set
  of announcement channels. It is written down in the repository, not implied.
  probe-security-programs.py found nothing because the project publishes no
  /.well-known/security.txt and no bug-bounty platform page — the policy lives in
  SECURITY.md, which the automated probe does not read.
policy:
  url: https://github.com/envoyproxy/gateway/blob/main/SECURITY.md
  status: 200
  format: SECURITY.md
  securityTxt: null
  securityTxtNote: >-
    No /.well-known/security.txt on any host — see well-known/envoy-gateway-well-known.yml.
    Publishing one on gateway.envoyproxy.io carrying the contact and policy URLs already in
    SECURITY.md is the single cheapest improvement available to this project.
contact:
  email: envoy-gateway-security@googlegroups.com
  method: private email to the security team
  publicIssuesProhibited: true
process:
  responseTarget: 3 business days
  triage: >-
    The security team validates scope, asks for detail, and identifies affected versions
    and impact, evaluating the report against the published Envoy Gateway threat model.
  threatModel: https://gateway.envoyproxy.io/docs/tasks/security/threat-model/
  tracking: draft GitHub Security Advisory recording affected versions, severity, CVSS, credits, fix status and disclosure plan
  privateFix: >-
    Fixes for accepted, undisclosed vulnerabilities are developed privately, using a GitHub
    Security Advisory temporary private fork where appropriate, coordinated with release
    managers for every affected active branch.
  maxEmbargo: 90 days
  maxEmbargoNote: >-
    Accepted privately disclosed vulnerabilities are fixed in supported non-EOL release
    branches or publicly disclosed within 90 days; an extension can be coordinated with the
    reporter in exceptional circumstances.
  cve: >-
    The team requests or attaches a CVE before public disclosure when appropriate.
  credit: Reporters are credited where applicable and with their consent.
announcementChannels:
  - https://github.com/envoyproxy/gateway/security/advisories
  - https://github.com/envoyproxy/gateway/releases
  - https://www.envoyproxy.io/slack
  - https://groups.google.com/g/envoy-gateway-announce
bugBounty:
  exists: false
  note: >-
    No HackerOne, Bugcrowd or Intigriti programme. Disclosure is unpaid and coordinated
    directly with the maintainers.
evidenceOfPractice:
  - id: CVE-2026-47775
    fixedIn: v1.9.1
    date: '2026-08-28'
    summary: >-
      Padding oracle in OAuth2/OIDC session cookies. Fixed by enabling AES-256-GCM
      encryption and disabling the legacy AES-256-CBC decryption path in the proxy
      bootstrap, with the operator consequence (existing sessions invalidated, replacement
      bootstraps need the runtime flags set by hand) documented in the release notes.
  - id: GHSA-w42f-28h3-998w
    fixedIn: v1.9.1
    date: '2026-08-28'
    summary: >-
      Confused-deputy / Pod Security Admission escape — a tenant-supplied
      KubernetesContainerSpec.SecurityContext on an EnvoyProxy replaced Envoy Gateway's
      hardened default outright instead of merging on top of it.
  - id: xds-auth-bypass-gatewaynamespacemode
    fixedIn: v1.9.0
    date: '2026-08-14'
    summary: >-
      xDS server authentication bypass in GatewayNamespaceMode, fixed with a unary
      interceptor and validation of state-of-the-world requests.
  - id: oci-wasm-http-downgrade
    fixedIn: v1.9.1
    date: '2026-08-28'
    summary: >-
      OCI Wasm image pulls silently downgraded to plain HTTP when the registry rejected
      HTTPS, letting an on-path attacker serve arbitrary Wasm code to the proxies.
observations:
  - >-
    The v1.8 branch was patched the same day as v1.9 (v1.8.4 and v1.9.1, both 2026-08-28),
    which is the documented policy actually being executed rather than merely stated.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com