PatchTheCVEenvoy vulnerabilities and fixes
Recent CVEs affecting envoy, with upgrade or downgrade steps. 14 tracked.
envoy has 14 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 14. Most recent: 2026-06-26. Highest priority: CVE-2026-47220 (score 49/100).
- CVE-2026-47220 HIGH 7.5 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-48042 HIGH 7.5 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-48044 HIGH 7.5 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-48743 HIGH 7.5 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-48090 MEDIUM 5.9 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-47221 MEDIUM 5.9 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-47205 MEDIUM 5.9 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-48706 MEDIUM 5.9 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-47204 MEDIUM 6.5 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-47207 MEDIUM 6.5 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-48497 MEDIUM 5.9 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-47775 MEDIUM 6.8 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-47778 MEDIUM 4.4 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
- CVE-2026-47692 MEDIUM 4.8 UPGRADE Envoy is an open source edge and service proxy designed for cloud-native applications
FAQ
How do I fix envoy vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is envoy being exploited right now?
None of the tracked envoy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which envoy CVE should I patch first?
CVE-2026-47220 currently ranks highest (49/100): Envoy is an open source edge and service proxy designed for cloud-native applications.