CVE-2026-47775: Envoy OAuth2 Padding Oracle – Credential Theft Risk

Technical summary

The OAuth2 HTTP filter in affected Envoy versions implements AES-256-CBC encryption for the PKCE code_verifier without authenticated encryption (AEAD) or HMAC verification. The /callback endpoint returns distinct HTTP responses (302 on successful decryption, 401 on padding failure), enabling a padding oracle attack. An attacker with access to the encrypted CodeVerifier cookie can exploit this oracle to recover the plaintext code_verifier in approximately 6,200 requests over roughly 100 seconds. With the recovered code_verifier and a stolen authorization code, the attacker can complete an OAuth2 token exchange to obtain a victim's access token. This attack chain requires obtaining the encrypted cookie and authorization code but does not require network access to the victim's endpoint.

Business impact

Organizations running Envoy as an OAuth2 gateway face credential compromise risk. Successful exploitation allows attackers to obtain valid access tokens for victim accounts without knowing passwords, enabling unauthorized API access, data exfiltration, or lateral movement within the application ecosystem. The attack requires moderate sophistication—obtaining both the encrypted cookie and a valid authorization code—but is feasible in scenarios where authorization codes are broadcast or leaked through secondary channels. For SaaS providers and enterprises using Envoy to protect microservices, this creates a pathway to authenticated API abuse and session hijacking.

Affected systems

Envoy versions 1.35.0 through 1.35.10, 1.36.0 through 1.36.6, 1.37.0 through 1.37.2, and all versions before 1.38.1 are affected. The vulnerability is present in the OAuth2 HTTP filter component. Organizations should verify their Envoy deployment version and check whether the OAuth2 filter is active in their proxy configuration. The issue does not affect Envoy installations not using the OAuth2 HTTP filter.

Exploitability

The attack is feasible but requires intermediate effort. An attacker must (1) observe or intercept the encrypted CodeVerifier cookie, (2) possess a valid authorization code (obtained through phishing, MITM, or authorization server compromise), and (3) send ~6,200 requests to the callback endpoint to mount the oracle. The timing (~100 seconds) is practical for active attacks. User interaction is required in the form of the victim initiating an OAuth2 login, which is common. Network access is required but no special privileges are needed. The CVSS score of 6.8 (MEDIUM) reflects the need for user interaction and high complexity, balanced against high impact on confidentiality and integrity.

Remediation

Upgrade to Envoy 1.35.11, 1.36.7, 1.37.3, or 1.38.1 or later. These versions replace the vulnerable encryption scheme with authenticated encryption (AEAD), eliminating the padding oracle. Consult the official Envoy release notes to confirm the exact patch versions and any associated configuration changes. As an interim mitigation, restrict network access to the /callback endpoint, use firewall rules to limit requests from untrusted networks, and monitor callback endpoint logs for unusual request patterns (high 401 response rates).

Patch guidance

Apply updates in accordance with your change management process. Test the patched version in a staging environment to confirm OAuth2 login functionality works as expected. Verify that the OAuth2 filter is still properly configured after the upgrade. No breaking changes are anticipated, but review the Envoy release notes for your specific version path. Priority should be given to production Envoy instances handling external-facing OAuth2 flows, particularly those protecting sensitive APIs or user data.

Detection guidance

Monitor Envoy access logs for patterns consistent with oracle attacks: a spike in requests to the /callback endpoint, a high ratio of 401 (padding failure) responses relative to 302 (success) responses within a short time window, or requests originating from a single source IP repeating the same cookie value with variations. Enable detailed logging on the OAuth2 filter if available. Consider alerting on >100 requests to /callback from a single IP within 5 minutes. Network-based detection of encrypted CodeVerifier exfiltration is difficult without decryption context, but monitoring for anomalous POST/GET patterns to the callback endpoint can provide visibility.

Why prioritize this

Although not yet on the CISA KEV list, this vulnerability merits prompt patching because it enables practical credential theft in OAuth2 deployments. The attack is reliable, requires only ~100 seconds, and does not require privileged network position if the attacker can obtain the authorization code through secondary means. Any Envoy deployment handling OAuth2 for production services should be prioritized. Organizations with defense-in-depth (rate limiting, IP restrictions on /callback) can tolerate slightly lower urgency, but patches should be planned within the current month.

Risk score, explained

The CVSS 6.8 MEDIUM score reflects high confidentiality and integrity impact (access token theft) offset by attack complexity (requires cookie + authorization code + 6,200 requests) and required user interaction (victim must initiate login). The vulnerability is not a zero-day and does not enable remote code execution. For organizations operating Envoy in zero-trust or air-gapped networks, the risk is lower; for internet-facing deployments, the risk is high because attackers can feasibly obtain authorization codes through phishing or breach-sourced data.

Frequently asked questions