Envoy Gateway versions prior to 1.5.7 and 1.6.2 contain a vulnerability where EnvoyExtensionPolicy Lua scripts can leak proxy credentials. These leaked credentials enable unauthorized communication with the control plane and access to all Envoy proxy secrets including TLS private keys and communication credentials. The vulnerability affects both standalone and Kubernetes-based Envoy Gateway deployments. Fixed versions 1.5.7 and 1.6.2 are available to address this security issue.