project

Envoy

Open-source L7 edge and service proxy, widely deployed as an ingress gateway and as the data plane of service meshes.

Current clusters

Two chained N-central bugs hand an unauthenticated caller a System administrator account

Rapid7 found CVE-2026-86206 and CVE-2026-86207 while pulling on an earlier N-central bypass, and chained they give a remote caller the top account on the console MSPs use to reach client networks. Hotfix 3 closes both.

Publishers:blog.rapid7.com

Reality

Evidence68
Adoption: Insufficient
Hype gap+12
Incentives60
Confidence58