Gloo Mesh Vulnerability Disclosure

generated: '2026-09-12'
method: searched
probe: true
source: https://www.solo.io/security
policy_url: https://www.solo.io/security
contact: security@solo.io
contact_type: email
bug_bounty: null
bug_bounty_note: >-
  No bug bounty program (HackerOne / Bugcrowd / Intigriti) is advertised. Disclosure is a
  direct, private mailing-list report.
security_txt: null
security_txt_note: >-
  No /.well-known/security.txt is served on any solo.io host — probed 2026-09-12, all 404.
  The policy exists as an HTML page only, so a machine cannot discover the reporting address
  from the RFC 9116 location. This is a one-file fix available to the provider.
policy:
  report_to: security@solo.io (private mailing list)
  non_security_bugs: >-
    Ordinary product bugs go to the related open-source project's issue tracker, not to the
    security list.
  when_to_report:
    - a potential security vulnerability in any product or project led by Solo.io
  handling:
    - Every report is investigated.
    - >-
      Once a vulnerability is characterized, the fix is developed and tested in a PRIVATE
      GitHub repository to prevent premature disclosure.
    - >-
      On the chosen disclosure day, fixes are merged from the private repository into the
      appropriate public branches and release engineers publish the binaries.
product_cve_process:
  docs: https://docs.solo.io/gloo-mesh-enterprise/latest/reference/security_updates/cve-lifecycle
  scans: https://docs.solo.io/gloo-mesh-enterprise/latest/reference/security_updates/cve-scans
  stages: [Inbound, Tracking, Analysis, Remediation, Reporting]
  tracking_threshold: >-
    All CRITICAL and HIGH CVEs; MODERATE and LOW when they materially affect the security
    posture. Embargoed CVEs are tracked in a separate repository under the constraints of the
    upstream security workgroup.
  reporting: >-
    Security scan results for product images are published in the product documentation with
    each release.
  upstream: >-
    Solo.io participates in early disclosure and security workgroups of multiple upstream
    communities (Istio, Envoy).
evidence:
  - source: https://www.solo.io/security
    http_status: 200
    kind: disclosure policy page
    keywords:
      - Reporting a vulnerability
      - security@solo.io
      - private GitHub repository
      - Public disclosure
  - source: https://docs.solo.io/gloo-mesh-enterprise/latest/reference/security_updates/cve-lifecycle
    http_status: 200
    kind: product CVE lifecycle policy