Improper Authentication in the jwt_authn HTTP filter in envoyproxy envoy versions up to and including 1.38.0 allows an unauthenticated attacker to byp

Summary

Improper Authentication in the jwt_authn HTTP filter in envoyproxy envoy versions up to and including 1.38.0 allows an unauthenticated attacker to bypass JWT requirements by sending a duplicate trigger header. When a JWT requirement is scoped to a specific header, supplying that header twice with any second value causes the requirement to silently not apply, allowing the request to reach the upstream backend without any token check.

Remediation

1. Inventory every envoyproxy envoy deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/envoyproxy/envoy/security/advisories/GHSA-67v5-5298-mjc3