EUVD-2026-84120Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Envoy route with path-based RBAC DENY
-
DeliveryCraft request /admin;x=y with semicolon path parameter
-
ExploitRouter strips suffix, RBAC evaluates raw path
-
ExecutionDENY rule misses, request routed to protected backend
-
ImpactReach protected endpoint bypassing authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
| Exploitation Conditions | Exploitation requires a specific configuration coincidence, not a default deployment: (1) the route must have ignore_path_parameters_in_path_matching enabled; (2) a path-based RBAC rule (url_path via PathMatcher or UriTemplateMatcher) must be present, typically a DENY on a protected path such as /admin; and (3) the crafted request (e.g. /admin;x=y) must still match the protected route after the router strips the semicolon path-parameter suffix. When all three hold, an unauthenticated network client bypasses the RBAC DENY. Limiting factors: the vulnerable path-parameter-stripping route option is non-default, and deployments without path-based RBAC DENY rules are unaffected; the guard envoy.reloadable_features.rbac_respect_ignore_path_parameters can also be used to control the fixed behavior. |
| Impact | This is a genuine but tightly-gated authorization-bypass in Envoy, a ubiquitous CNCF edge/service proxy (Istio, service meshes, API gateways). The vendor CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) is well-reasoned and I concur: network-reachable and unauthenticated (PR:N), but AC:H correctly reflects that exploitation requires a specific, non-default configuration coincidence - the route must have ignore_path_parameters_in_path_matching enabled AND a path-based RBAC url_path rule must be present AND the request must still route to the protected backend after semicolon stripping. Scope change (S:C) is justified because RBAC (the security authority being bypassed) is distinct from the protected upstream the request then reaches. No EPSS score, no CISA KEV entry, and no public exploit are present in the supplied intelligence, so this is 'no public exploit identified at time of analysis' - not active exploitation. The realistic priority is HIGH for the subset of operators who use RBAC path DENY rules together with ignore_path_parameters_in_path_matching (a common CVE-436 canonicalization mismatch pattern), and LOW for everyone else. Note the tag 'Authentication Bypass' is a mislabel: the description explicitly says 'path-based authorization,' and no authentication step is defeated - this is an access-control/authorization bypass. This is one of a large cluster of same-release Envoy fixes; the closely related CVE-2026-73551 covers a sibling semicolon-parameter path-confusion issue. |
| Exploit ScenarioDerived | An operator protects an admin API with an Envoy RBAC DENY rule matching url_path /admin and has ignore_path_parameters_in_path_matching enabled on that route. An unauthenticated attacker sends GET /admin;x=y: the router strips the ;x=y suffix and matches the protected /admin backend, but the RBAC matcher evaluates the raw /admin;x=y, misses the DENY rule, and forwards the request - reaching the protected endpoint. No public proof-of-concept is present in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Path-based RBAC authorization bypass in Envoy Proxy lets an unauthenticated remote client reach protected backends such as /admin by appending a semicolon path parameter (e.g. /admin;x), because the router strips that suffix before route matching while the RBAC url_path matcher evaluates the untouched raw path. Exploitation is tightly gated rather than default: it requires a route configured with ignore_path_parameters_in_path_matching, a path-based RBAC rule (PathMatcher or UriTemplateMatcher) guarding the protected path, and a crafted request that still selects the protected route after stripping. All releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are affected; the vendor has published fixed releases, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 (matching your release branch) - see advisory GHSA-77x5-xqjg-hprq and the release tags https://github.com/envoyproxy/envoy/releases/tag/v1.36.10, v1.37.6, v1.38.4, and v1.39.1. If an immediate upgrade is not possible, the most direct compensating control is to remove or disable the route option ignore_path_parameters_in_path_matching on any route also covered by a path-based RBAC rule; the trade-off is that requests carrying semicolon path parameters will no longer be canonicalized the way those routes previously expected, which can change route matching behavior and may break clients that legitimately use matrix parameters. Deployments where the router/RBAC inconsistency cannot be eliminated should stop relying on url_path DENY rules for sensitive prefixes and instead enforce authorization at the application, at an upstream gateway, or with non-path RBAC attributes (for example header, JWT claim, or mTLS identity matchers); this preserves protection but requires re-authoring policy and re-testing. Note that setting the runtime guard envoy.reloadable_features.rbac_respect_ignore_path_parameters to false disables the new stripping behavior and restores the vulnerable mismatch - it is a temporary rollback lever for behavior compatibility after patching, not a mitigation. To scope exposure, audit Envoy configurations for routes where both ignore_path_parameters_in_path_matching and a path-based RBAC rule are enabled, and check access logs for requests containing semicolons in path segments; when neither condition is present (the common case), no action beyond normal upgrade cadence is required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-436 (Interpretation Conflict): two Envoy subsystems canonicalize the request path differently. HTTP matrix/path parameters are the semicolon-delimited components of a path segment (RFC 3986 path-segment parameters), which some routing stacks strip before matching. Envoy's router honors the per-route option ignore_path_parameters_in_path_matching and removes those suffixes (so /admin;x=y/action;foo=bar is evaluated as /admin/action), but the RBAC filter's url_path matchers - both the PathMatcher and the UriTemplateMatcher implementations in source/extensions/filters/common/rbac/matchers.cc - previously called headers.getPathValue() directly and matched against the raw, unstripped path. The two evaluations could therefore disagree, letting a request miss a DENY rule while still being routed to the rule's intended target. The fix threads the router's CommonConfig through to the RBAC matchers: when ignorePathParametersInPathMatching() is true for the route's virtual host, the matcher now calls Http::PathUtil::removePathParameters() on the path before matching. The change is gated behind the reloadable runtime feature envoy.reloadable_features.rbac_respect_ignore_path_parameters, and the CVSS vector's scope change (S:C) with high confidentiality impact (C:H) and low integrity impact (I:L) reflects that the bypass crosses the intended authorization boundary while the high attack complexity (AC:H) captures the multi-part configuration prerequisite, not attacker skill or race conditions.
Know when Envoy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because it needs the non-default route option plus a path-based RBAC DENY that still matches after stripping; S:C as bypassed RBAC differs from reached backend.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Technical POC Analysis
Bug class: CWE-436, Interpretation Conflict (the CVE record assigns this; the GitHub advisory GHSA-77x5-xqjg-hprq lists no CWE).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Envoy Proxy, used as an edge proxy and service-mesh sidecar across many production environments, has a path-handling weakness that can let a remote client reach backends that role-based access control was meant to block - including administrative endpoints such as /admin. Exposure is not universal: it requires a specific combination of a route configured with ignore_path_parameters_in_path_matching and a path-based RBAC rule guarding the protected path, so the risk is concentrated in organizations with customized Envoy routing rather than default deployments. Because the bypass can expose administrative control planes, leadership should treat it as a priority remediation item and confirm version coverage across the entire Envoy fleet, including sidecars and gateways. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Apply vendor patch (upgrade to 1.36.10, 1.37.6, 1.38.4, or 1.39.1).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB