CVE-2024-23324

HIGH

Envoy 1.26.0-1.26.6 - Authentication Bypass via Invalid gRPC Request

Title source: llm

Description

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6

Patch, Vendor Advisory x_refsource_misc

https://github.com/envoyproxy/envoy/commit/29989f6cc8bfd8cd2ffcb7c42711eb02c7a5168a

View Patch ZIP pw:eip

Scores

CVSS v3 8.6

EPSS 0.0060

EPSS Percentile 44.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-20

Status published

Products (1)

envoyproxy/envoy 1.26.0 - 1.26.7

Published Feb 09, 2024

Tracked Since Feb 18, 2026