CVE-2026-47775

score

1.7

cvss

6.8

epss

0.2%

published

2026-06-26

kev added

—

first seen

2026-10-21

Envoy < 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contains a padding oracle vulnerability caused by use of AES-256-CBC without authentication tag in OAuth2 HTTP filter encrypt()/decrypt() functions, letting attackers recover plaintext PKCE code_verifier and access tokens, exploit requires attacker to obtain encrypted CodeVerifier cookie.