The vulnerability is a code injection flaw in Envoy Gateway’s Lua policy handler. By supplying a malicious Lua script through an EnvoyExtensionPolicy, an attacker can have the script executed with Envoy’s privileges, enabling the extraction of the proxy’s internal credentials. Those credentials can then be used to communicate with the control plane and access all secrets stored by Envoy, such as TLS private keys and downstream/upstream communication credentials. The weakness is identified as CWE‑94.

Envoy Gateway versions before 1.5.7 for the 1.5.x branch and before 1.6.2 for the 1.6.x branch are affected. All deployments using those versions that allow custom Lua policies are at risk. The issue is fixed in 1.5.7 and 1.6.2 and later releases.

The CVSS score of 8.8 denotes high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog at this time. Exploitation requires control over the Lua policy configuration, which is typically available to operators or anyone able to inject a policy. If such access exists, the attacker can immediately extract credentials and consequently compromise all secrets used by the Envoy instance.