Envoy · Envoy · CVE-2024-23324
**Name of the Vulnerable Software and Affected Versions**
Envoy versions prior to 1.26.7
Envoy versions prior to 1.27.3
Envoy versions prior to 1.28.1
Envoy versions prior to 1.29.1
**Description**
The issue exists due to insufficient input validation in the Envoy proxy server, allowing remote attackers to bypass the authentication process. Downstream clients can force invalid gRPC requests to be sent to ext authz, circumventing ext authz checks when failure mode allow is set to true.
**Recommendations**
For versions prior to 1.26.7, upgrade to version 1.26.7 or later.
For versions prior to 1.27.3, upgrade to version 1.27.3 or later.
For versions prior to 1.28.1, upgrade to version 1.28.1 or later.
For versions prior to 1.29.1, upgrade to version 1.29.1 or later.
As a temporary workaround, consider setting failure mode allow to false to prevent bypassing ext authz checks.