CVE-2025-50113: Auth Bypass in EnvoyExtensionPolicy leads to Secret Leakage

Summary of Critical Vulnerability Information Vulnerability Overview Title: Authentication bypass and subsequent key leakage in EnvoyExtensionPolicy Lua due to improper input validation CVE ID: CVE-2025-50113 Severity: Critical (CVSS 9.1/10) Description: The function (security.lua:29-43) fails to collapse redundant path separators ( → ). On Linux, is equivalent to (POSIX path semantics), but fails to match the double-slash variant because does not start with . Impact: An attacker can read arbitrary files in the filesystem of the Gateway controller's Pod by submitting Lua code as an , including: - - The Kubernetes Service Account token ( ) - TLS certificates ( ) - Process environment ( ) - These credentials can be used to access sensitive information from the K8s API Server or the Gateway XDS service. Scope of Impact Affected Versions: < 1.7.4, < 1.8.1 Fixed Versions: 1.7.4, 1.8.1 Weakness Classification: CWE-20 (Improper Input Validation) Fix Details Fixed in v1.7.4 and v1.8.1. The fix includes: - Collapsing redundant path separators ( → ) for double-slash variants such as and , ensuring they are matched by . - Rewriting the traversal check to reject or segments appearing in any position or spanning both separator styles ( , , ). POC / Exploit Code No POC or exploit code block is included in the screenshots. Interim Mitigations Refer to the Warning section in the Lua documentation and implement the recommended measures to reduce risk.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-50113: Auth Bypass in EnvoyExtensionPolicy leads to Secret Leakage

More from this source