UpHeron
All vulnerabilities

Servers and applications

CVE-2022-29226

oauth filter allows trivial bypass

Severity
Critical 9.1
Published
9 Jun 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.22.1
Also known as
GHSA-h45c-2f94-prxh
Sources
NVD, Project advisories (GitHub)

Description

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.22.1
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.22.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-29226
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-29226
  • GitHub Advisory Database https://github.com/advisories/GHSA-h45c-2f94-prxh
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh