UpHeron
All vulnerabilities

Servers and applications

CVE-2020-8664

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.

Severity
Medium 5.3
Published
4 Mar 2020
Last changed
2 Oct 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version up to 1.13.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-8664
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-8664