Configuration in envoy - CVE-2022-21654
Published: February 22, 2022 / Updated: August 26, 2026
Vulnerability identifier: #VU145840
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-21654
CWE-ID: CWE-16
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass mutual TLS client certificate re-validation and reuse an existing session under outdated validation settings.
The vulnerability exists due to improper configuration handling in mTLS session validation in envoy when reusing an existing session after validation settings have changed. A remote user can continue using a previously established session to bypass mutual TLS client certificate re-validation and reuse an existing session under outdated validation settings.
User interaction is required.
Affected software
envoy
How to mitigate CVE-2022-21654
Install security update from vendor's website.
envoy - addressed in versions 1.18.6, 1.19.3, 1.20.2, 1.21.1