EnvoyApplication · Envoyproxy

CVE-2024-45806

MEDIUM · 6.5 CVSS v3.1 Published 2024-09-20
Fix available
A fix is available. Upgrade to 1.28.7 / 1.29.9 or later.
See remediation →
74/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for handling internal addresses in Envoy has been changed. Previously, RFC1918 IP addresses were automatically considered internal, even if the internal_address_config was empty. The default configuration of Envoy will continue to trust internal addresses while in this release and it will not trust them by default in next release. If you have tooling such as probes on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers) please explicitly include those addresses or CIDR ranges into `internal_address_config`. Successful exploitation could allow attackers to bypass security controls, access sensitive data, or disrupt services within the mesh, like Istio. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Envoy proxy incorrectly trusted all RFC1918 private addresses as internal by default, allowing external clients on those networks to manipulate x-envoy headers and bypass security controls within the service mesh.

MitigationUpgrade to Envoy versions 1.31.2, 1.30.6, 1.29.9, or 1.28.7; alternatively, explicitly configure internal_address_config to only include truly trusted CIDR ranges.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
EnvoyApplication
Affected:< 1.28.7>= 1.29.0, < 1.29.9>= 1.30.0, < 1.30.6>= 1.31.0, < 1.31.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Determine installed Envoy version
    Run `envoy --version` or check the container/daemon metadata to find the exact version number
    Affected if The version is < 1.28.7, >= 1.29.0 and < 1.29.9, >= 1.30.0 and < 1.30.6, or >= 1.31.0 and < 1.31.2
  2. Check if internal_address_config is explicitly configured
    Search Envoy configuration files (YAML/JSON) for the `internal_address_config` setting under the bootstrap or listener configuration
    Affected if The setting is absent and Envoy uses the default behavior of treating all RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) as internal
  3. Inspect listener configuration for external network exposure
    Review Envoy listener definitions to identify if any listeners bind to RFC1918 addresses that are accessible to untrusted external clients
    Affected if Listeners accept connections from RFC1918 addresses that are not truly trusted internal networks (e.g., guest WiFi, shared hosting networks)
  4. Examine header handling for x-envoy internal validation
    Check if Envoy configuration relies on x-envoy-internal header or remote IP validation for access control decisions
    Affected if Security policies trust x-envoy-internal headers or internal address classification without explicit configuration

You are affected if your Envoy version falls within the vulnerable ranges AND you have not explicitly configured internal_address_config AND your Envoy listeners accept connections from RFC1918 networks that contain untrusted external clients.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 1.28.7 / 1.29.9 / 1.30.6 or later
Fixed in 1.28.71.29.91.30.6
Interim mitigation

Upgrade to Envoy versions 1.31.2, 1.30.6, 1.29.9, or 1.28.7; alternatively, explicitly configure internal_address_config to only include truly trusted CIDR ranges.

Recommended fix High confidence

Upgrade to Envoy 1.31.2 (or 1.30.6/1.29.9/1.28.7 depending on your release cadence)

  1. 1. Identify the current Envoy version running in your environment using `envoy --version` or checking your deployment manifests
  2. 2. Select an appropriate fixed version from: 1.31.2, 1.30.6, 1.29.9, or 1.28.7 (prefer 1.31.2 for the latest stable release with the fix)
  3. 3. Update your package manager or container image to the selected fixed version
  4. 4. If you have tooling or probes on private networks that need to be trusted (e.g., to modify x-envoy headers), explicitly add those addresses/CIDR ranges to the `internal_address_config` in your Envoy configuration
  5. 5. Deploy the upgraded Envoy version
  6. 6. Verify the new version is running: `envoy --version`
  7. 7. Test that your mesh services (including Istio) function correctly after the upgrade
Caveat The default behavior change noted in the description will occur in a future release (not trust RFC1918 by default), but this release maintains backward compatibility

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Envoy Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-45806 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-45806 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data