Skip to content

security: Upgrade Envoy Gateway from v1.2.8 to v1.6.3 (CVE-2026-22771) #1985

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NJX-njx wants to merge 3 commits into
base: main
Choose a base branch
from
Open

security: Upgrade Envoy Gateway from v1.2.8 to v1.6.3 (CVE-2026-22771) #1985

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
09a7fa1
security: upgrade Envoy Gateway from v1.2.8 to v1.6.3 (#1888)
NJX-njx Mar 4, 2026
d13b3a2
Merge branch 'main' into feat/1888-envoy-gateway-upgrade
varungup90 Mar 5, 2026
d42c746
Merge branch 'main' into feat/1888-envoy-gateway-upgrade
varungup90 Mar 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions config/dependency/envoy-gateway/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
kind: Kustomization

resources:
- https://github.com/envoyproxy/gateway/releases/download/v1.2.8/install.yaml
- https://github.com/envoyproxy/gateway/releases/download/v1.6.3/install.yaml

Comment on lines 3 to 5
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This upgrade appears incomplete: there are still references to the vulnerable Envoy Gateway version v1.2.8 in Helm chart values (e.g., dist/chart/stable.yaml, dist/chart/values.yaml, dist/chart/vke.yaml). As a result, Helm-based installs can still deploy the old envoyproxy/gateway:v1.2.8 shutdown-manager image despite updating the kustomize dependency here. Please update those chart files (or narrow the PR description/scope) so all install paths are consistently on v1.6.3.

Copilot uses AI. Check for mistakes.
Copy link
Collaborator

@varungup90 varungup90 Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, update the dist/ files as well

Copy link
Collaborator

@varungup90 varungup90 Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI uploaded these two images

aibrix-public-release-cn-beijing.cr.volces.com/aibrix/envoy:v1.36.4
aibrix-public-release-cn-beijing.cr.volces.com/aibrix/gateway:v1.6.3

patches:
- path: envoy_gateway_patch.yaml

images:
- name: envoyproxy/gateway
newName: envoyproxy/gateway
newTag: v1.2.8
newTag: v1.6.3
2 changes: 1 addition & 1 deletion config/gateway/gateway.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ spec:
cpu: 1
memory: 1Gi
- name: shutdown-manager
image: envoyproxy/gateway:v1.2.8
image: envoyproxy/gateway:v1.6.3
resources:
requests:
cpu: 10m
Expand Down
2 changes: 1 addition & 1 deletion config/overlays/release/envoy_proxy_patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,6 @@ spec:
cpu: 2
memory: 8Gi
- name: shutdown-manager
image: envoyproxy/gateway:v1.2.8
image: envoyproxy/gateway:v1.6.3
envoyPDB:
minAvailable: 1
2 changes: 1 addition & 1 deletion config/overlays/vke/default/envoy_proxy_patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ spec:
cpu: 2
memory: 8Gi
- name: shutdown-manager
image: aibrix-cn-beijing.cr.volces.com/aibrix/gateway:v1.2.8
image: aibrix-cn-beijing.cr.volces.com/aibrix/gateway:v1.6.3
resources:
requests:
cpu: 10m
Expand Down
2 changes: 1 addition & 1 deletion config/overlays/vke/dependency/envoy_gateway_patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ data:
provider:
kubernetes:
shutdownManager:
image: aibrix-cn-beijing.cr.volces.com/aibrix/gateway:v1.2.8
image: aibrix-cn-beijing.cr.volces.com/aibrix/gateway:v1.6.3
type: Kubernetes
gateway:
controllerName: gateway.envoyproxy.io/gatewayclass-controller
Expand Down
2 changes: 1 addition & 1 deletion config/overlays/vke/dependency/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,4 @@ patches:
images:
- name: envoyproxy/gateway
newName: aibrix-cn-beijing.cr.volces.com/aibrix/gateway
newTag: v1.2.8
newTag: v1.6.3
2 changes: 1 addition & 1 deletion docs/source/getting_started/installation/installation.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ Prerequisites
.. code:: bash

# Install envoy-gateway, this is not aibrix component. you can also use helm package to install it.
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.2.8 -n envoy-gateway-system --create-namespace
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.6.3 -n envoy-gateway-system --create-namespace

# patch the configuration to enable EnvoyPatchPolicy, this is super important!
kubectl apply -f - <<EOF
Expand Down
2 changes: 1 addition & 1 deletion hack/release/sync-dependency-images.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ TARGET_REGISTRY=$1
IMAGES=(
"redis:7.4 ${TARGET_REGISTRY}/aibrix/redis:7.4"
"envoyproxy/envoy:v1.33.2 ${TARGET_REGISTRY}/aibrix/envoy:v1.33.2"
"envoyproxy/gateway:v1.2.8 ${TARGET_REGISTRY}/aibrix/gateway:v1.2.8"
"envoyproxy/gateway:v1.6.3 ${TARGET_REGISTRY}/aibrix/gateway:v1.6.3"
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To improve maintainability and reduce the chance of errors in future updates, consider defining the version as a variable and reusing it. This avoids hardcoding the version string in multiple places on the same line.

For example:

ENVOY_GATEWAY_VERSION="v1.6.3"
# ... in IMAGES array
    "envoyproxy/gateway:${ENVOY_GATEWAY_VERSION} ${TARGET_REGISTRY}/aibrix/gateway:${ENVOY_GATEWAY_VERSION}"

Applying this pattern to all images in the IMAGES array would further improve the script's maintainability.

"aibrix/kuberay-operator:v1.2.1-patch-20250726 ${TARGET_REGISTRY}/aibrix/kuberay-operator:v1.2.1-patch-20250726"
"busybox:stable ${TARGET_REGISTRY}/aibrix/busybox:stable"
)
Expand Down
Loading