CVE-20XX-?
agent?

Envoyproxy Envoy CVEs.

Published CVEs affecting Envoyproxy Envoy, ranked by exploit odds.

1 CVEs · updated 2026-11-12 19:15 UTC

Reset all
  1. CVE-2026-107492

    Improper Authentication in the jwt_authn HTTP filter in envoyproxy envoy versions up to and including 1.38.0 allows an unauthenticated attacker to bypass JWT requirements by sending a duplicate trigger header. When a JWT requirement is scoped to a specific header, supplying that header twice with any second value causes the requirement to silently not apply, allowing the request to reach the upstream backend without any token check.

    Auth & access Envoyproxy Envoy

    10.0 CRITICAL Fix listed

All CVEs affecting Envoyproxy Envoy that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.