Log in Start free

Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-73553Envoy: RBAC Authorization Bypass via Path Parameters

High 7.5

In plain English

A high-severity security flaw in envoy from envoyproxy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 56.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Affected products (as reported)

VendorProductVersions
envoyproxy envoy < 1.36.10>= 1.37.0, < 1.37.6>= 1.38.0, < 1.38.4>= 1.39.0, < 1.39.1

Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

References