CVE-2020-8664

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-25)

CWE

CWE-287

Published

2020-03-04

Modified

2026-10-02

Record from

the NVD, synced 2026-10-19

Affected

• envoyproxy:envoy

References

• https://access.redhat.com/errata/RHSA-2020:0734
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-3x9m-pgmg-xpx8
• https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history
• https://access.redhat.com/errata/RHSA-2020:0734
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-3x9m-pgmg-xpx8

Check your stackJSON