CVE-2022-29226

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.

• CWE-306

• https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360Patch, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxhThird Party Advisory
• https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360Patch, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxhThird Party Advisory

Published

Jun 9, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29220github-action-merge-dependabot is an action that automatical…6.5
• CVE-2022-29221Smarty is a template engine for PHP, facilitating the separa…8.8
• CVE-2022-29222Pion DTLS is a Go implementation of Datagram Transport Layer…7.5
• CVE-2022-29223Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-29224Envoy is a cloud-native high-performance proxy. Versions of …5.9
• CVE-2022-29225Envoy is a cloud-native high-performance proxy. In versions …7.5
• CVE-2022-29227Envoy is a cloud-native high-performance edge/middle/service…7.5
• CVE-2022-29228Envoy is a cloud-native high-performance proxy. In versions …7.5
• CVE-2022-29229CaSS is a Competency and Skills System. CaSS Library, (npm:c…7.2
• CVE-2022-2923NULL Pointer Dereference in GitHub repository vim/vim prior …5.5
• CVE-2022-29230Hydrogen is a React-based framework for building dynamic, Sh…5.4
• CVE-2022-29232BigBlueButton is an open source web conferencing system. Sta…6.5