PatchTheCVECVE-2025-24030: Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based applicati
CVE-2025-24030 is a high-severity flaw (CVSS 7.1) affecting gateway. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Ve
Why this priority
- High severity
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.1 (High) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 64%) |
| CISA exploited list | No |
| Weakness | CWE-419 |
| Published | 2025-01-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-24030?
gateway: upgrade to 1.2.6. Exact commands for each OS are on this page.
Is CVE-2025-24030 being exploited?
CVE-2025-24030 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-24030 affect?
CVE-2025-24030 affects gateway. Severity is high (CVSS 7.1). Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands
How urgent is CVE-2025-24030?
Priority 39/100. High severity; On your watchlist
Software pages
Kubernetes vulnerabilities · Envoy vulnerabilities
Related CVEs
- CVE-2026-22771 HIGH 8.8 UPGRADE Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based applicati
- CVE-2023-24488 MEDIUM 6.1 UPGRADE UPGRADE Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross s
- CVE-2023-24487 MEDIUM 6.3 UPGRADE UPGRADE Arbitrary file read in Citrix ADC and Citrix Gateway
- CVE-2022-38368 HIGH 8.8 UPGRADE An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376
- CVE-2022-31805 HIGH 7.5 UPGRADE UPGRADE In the CODESYS Development System multiple components in multiple versions transmit the passwords for the comm