← Back

CVE-2024-23324

nvd nist
Published: Feb 9, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected (4)

Products: Envoyproxy: Envoy
Envoyproxy
1 product
Envoy
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Envoyproxy
Envoy
From 1.26.0 to 1.26.7
Envoy
From 1.27.0 to 1.27.3
Envoy
From 1.28.0 to 1.28.1
Envoy
From 1.29.0 to 1.29.1

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.