Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M
CVE-2026-26308Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation
High 7.5
In plain English
A high-severity incorrect authorization in envoy from envoyproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/envoyproxy/envoy | 1.37.1 | GHSA-ghc4-35x6-crw5 |
| Go | github.com/envoyproxy/envoy | 1.36.5 | GHSA-ghc4-35x6-crw5 |
| Go | github.com/envoyproxy/envoy | 1.35.9 | GHSA-ghc4-35x6-crw5 |
| Go | github.com/envoyproxy/envoy | 1.34.13 | GHSA-ghc4-35x6-crw5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| envoyproxy | envoy | >= 1.37.0, < 1.37.1>= 1.36.0, < 1.36.5>= 1.35.0, < 1.35.9< 1.34.13 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N