Is CVE-2025-24030 actively exploited?

CVE-2025-24030 has no public evidence of in-the-wild exploitation as of 2025-09-04.

What is the CVSS score for CVE-2025-24030?

CVE-2025-24030 has a CVSS score of 7.1 (HIGH severity). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H.

How do I patch CVE-2025-24030?

Patch guidance is available from envoyproxy security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2025-24030.

Fix CVE-2025-24030 - HIGH envoyproxy gateway

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.

CVSS Metrics

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack Vector: adjacent network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: high
Weaknesses: CWE-419

Metadata

Primary Vendor: ENVOYPROXY
Published: 1/23/2025
Last Modified: 9/4/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

envoyproxy : gateway

Remediation Guidance

Executive Summary

Cite this page

CVE-2025-24030. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2025-24030

View on NIST NVD

CVE-2025-24030 vulnerability