Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Envoy Proxy Missing Authentication for Critical Function Vulnerability - CVE-2022-29226 - Vulnerability Database
Envoy Proxy

Envoy Proxy Missing Authentication for Critical Function Vulnerability - CVE-2022-29226

Critical
Reference: CVE-2022-29226
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-29226
Title: Envoy Proxy Missing Authentication for Critical Function Vulnerability
Overview:

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.