EUVD-2026-84114Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInject script payload into gRPC method path
-
DeliveryEnvoy caches it as dynamic stat name
-
ExploitOperator opens /stats?format=html
-
ExecutionStored name executes in admin origin
-
ImpactScript issues privileged same-origin admin requests
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires ALL of the following: Envoy built with HTML admin support (ENVOY_ADMIN_HTML) and the admin interface reachable from a browser (not bound to localhost-only / properly restricted); an enabled data-plane component that persists attacker-influenced text into statistic names - specifically the grpc_stats filter with stats_for_all_methods set to true so per-method dynamic stat names are created from request paths; and a human operator actually loading /stats?format=html in a browser (the trigger for script execution). Limiting factors: the admin endpoint is documented as sensitive and typically not internet-exposed; the vulnerable stat-name-generating feature is non-default; and successful impact depends on operator interaction (viewing the page). On patched builds the mitigation is additionally gated by the runtime flag envoy.reloadable_features.sanitize_html_stats_names. |
| Impact | This is a genuine but conditionally-gated stored XSS (CWE-79) in Envoy's admin interface. The vendor CVSS of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is internally inconsistent with the description: it scores UI:N despite the description explicitly stating impact occurs 'when an operator views the HTML stats page' - that is user interaction, so UI:R is more accurate and lowers the true score slightly. Conversely, the C:H/I:H rating is defensible because script executing in the admin-interface origin can issue privileged same-origin requests (arguably a scope change to S:C, which the vendor did not apply). AC:H is well-justified by the multiple gating conditions. No EPSS score, no CISA KEV listing, and no public exploit are present in the input - so exploitation status is 'no public exploit identified at time of analysis.' The realistic priority is MODERATE-but-conditional: the admin interface is not meant to be internet-facing and is often bound to localhost, the ENVOY_ADMIN_HTML build/feature and a stat-name-persisting component (grpc_stats with stats_for_all_methods) must both be active, AND a human operator must browse the HTML stats page. Where those align, the same-origin admin compromise is serious; where the admin port is properly restricted (the documented best practice), real-world exposure is low. No conflicting KEV/EPSS signals exist to reconcile. |
| Exploit ScenarioDerived | An attacker sends requests through an Envoy proxy whose grpc_stats filter has stats_for_all_methods enabled, embedding an HTML/script payload (e.g. a fake gRPC method or path segment) that Envoy folds verbatim into a dynamic statistic name. The malicious name is cached; when an operator later opens /stats?format=html in a browser, the unencoded name executes JavaScript in the admin interface's origin and can drive privileged same-origin admin API calls. No public exploit code is identified, though the fix commit includes an XSS integration test using a 'cluster_<script>alert(1)</script>' name that demonstrates the injection path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Stored cross-site scripting in Envoy Proxy's admin statistics page lets an attacker run script in the admin interface's origin: the /stats?format=html endpoint (StatsHtmlRender) sanitizes statistic values but emits statistic names raw, so a data-plane component that folds attacker-supplied request path segments into dynamic stat names - notably grpc_stats with stats_for_all_methods enabled - can persist a script-bearing name that fires when an operator opens the page in a browser. Every release before 1.36.10, 1.37.6, 1.38.4, and 1.39.1 is affected; the independently assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N (7.4), i.e. unauthenticated remote influence over the injected text but multiple gating prerequisites plus required operator interaction, with impact scoped to the admin origin where privileged same-origin requests can then be issued. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is realistic only where the admin HTML endpoint is browser-reachable and a dynamic-stat-generating component is enabled.
RemediationAI
Vendor-released patch: upgrade to Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on the maintained branch in use, per GHSA-pv9h-4fxf-7vrg (https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg); the fix sanitizes statistic names in StatsHtmlRender and is controlled by the runtime flag envoy.reloadable_features.sanitize_html_stats_names, so confirm the guard is left enabled (default) and not overridden to false in the bootstrap or admin runtime layer. If immediate upgrade is not possible, combine compensating controls and accept their trade-offs: bind the admin interface to a loopback or otherwise restricted listener and require an authenticated, non-browser-accessible path (blocks the browser-based trigger entirely but complicates legitimate operational tooling and health checks), build or run Envoy without the ENVOY_ADMIN_HTML option so /stats?format=html returns 400 (removes the vulnerable renderer but also removes a diagnostic feature some operators rely on), and disable the grpc_stats filter or leave stats_for_all_methods at its default false so per-method attacker-influenced stat names are never created (reduces gRPC observability granularity but eliminates the stored-text prerequisite). Consuming statistics through /stats?format=json or ?format=text/prometheus instead of the HTML view avoids the sink, and short of patching, admins should treat statistic names on the HTML page as untrusted and avoid loading /stats?format=html from a browser session with access to other admin endpoints. Note that no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so prioritization should reflect the gating prerequisites above rather than mass-exploitation urgency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Envoy's admin interface exposes a /stats?format=html view implemented by the StatsHtmlRender class, which extends StatsTextRender and builds the page from name/value fragment pairs. In the vulnerable code path, statistic values were passed through Html::Utility::sanitize() while statistic names were concatenated into the response verbatim, so any name containing the HTML metacharacters &, <, >, ", or ' was rendered as live markup - the classic CWE-79 stored (second-order) cross-site scripting pattern in which the untrusted data enters at one layer and is interpreted at another. The prerequisite for the stored component is that a stat name must be derived from attacker-controlled input and cached, which is how grpc_stats with stats_for_all_methods set to true behaves: per-method dynamic statistic names incorporate request path segments, giving an attacker a way to deposit a chosen string into Envoy's stats tree. The admin interface serving the HTML response is itself a privileged surface in the admin origin, so injected script executes with that origin's authority and can issue same-origin requests against other admin handlers. Only builds compiled with the ENVOY_ADMIN_HTML option expose the HTML renderer; when that option is absent the endpoint returns HTTP 400 with "HTML output was disabled", which the upstream integration test AdminStatsHtmlXss explicitly asserts alongside the expectation that a cluster named cluster_<script>alert(1)</script> is emitted as cluster_<script>alert(1)</script>. The fix introduces Html::Utility::requiresSanitization() (a quick find_first_of check for the five HTML metacharacters) and applies sanitization to names as well as values in both generate() paths, additionally gated at runtime by the reloadable feature flag envoy.reloadable_features.sanitize_html_stats_names, which allows operators to revert to pre-patch behaviour if the change causes compatibility problems.
Know when Envoy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attacker is unauthenticated (PR:N) but needs a non-default stat-persisting component and must wait for an operator to view the page (AC:H, UI:R); admin-origin script escaping to privileged requests justifies S:C with C:H/I:H, A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Technical POC Analysis
CWE-79 stored XSS in Envoy's admin stats renderer.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Envoy Proxy - the traffic-handling component underpinning many service meshes, API gateways, and edge deployments - is affected by a stored cross-site scripting flaw in its administrative statistics interface across all releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. An unauthenticated remote party can influence text that is persisted as a statistic name via a data-plane component that folds request path segments into dynamic stat names, and that payload executes in the browser of an operator who later opens the admin stats page. Because the injected script runs in the admin interface's own origin, a successful attack gives the intruder the operator's privileged position over the proxy's control surface, which is why this warrants management attention despite the multiple preconditions and required operator interaction.
No vendor-released patch identified at time of analysis; interim mitigations: restrict the Envoy admin interface to localhost or a dedicated management network with authentication and network policy, disable or avoid stats_for_all_methods in grpc_stats and other plugins that fold user-supplied request path segments into dynamic stat names, do not open /stats?format=html in privileged browser sessions, and monitor admin access logs for anomalous requests. Apply vendor patch when released (releases at or above 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are the stated thresholds).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB