EUVD-2026-84121Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Envoy fronting servlet backend
-
DeliveryCraft path with semicolon matrix parameter
-
ExploitEnvoy raw-path match selects unprotected fallback
-
ExecutionBackend strips per-segment param, resolves protected resource
-
ImpactAccess path-protected content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate name authentication
|
| Exploitation Conditions | Exploitation requires a deployment where Envoy makes a path-based decision (e.g., path-based route selection or path-based authorization protecting a resource) AND the upstream is a backend that strips semicolon matrix parameters per path segment, such as Apache Tomcat or other servlet containers. The bypass is triggered by placing a matrix parameter on the protected segment or on an earlier segment (e.g., /admin;x=1); it is aggravated when the ignore_path_parameters_in_path_matching option is used, since that only truncates at the first semicolon rather than stripping per segment. Limiting factors: without a semicolon-per-segment-stripping backend, or without a path-based Envoy policy, there is no bypass; the impact is confined to reaching an otherwise-protected resource (Low confidentiality), with no integrity or availability effect. The fix can be temporarily reverted via the runtime guard, so unpatched or reverted deployments remain exposed. |
| Impact | This is a genuine path-confusion / access-control bypass but a moderate-priority one, not a critical emergency. The vendor CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects unauthenticated network reachability but only Low confidentiality impact and no integrity/availability impact - consistent with reaching a protected resource by fooling Envoy's route/policy selection rather than achieving code execution. I assess AC as HIGH rather than Low: the description explicitly states the bypass requires BOTH a path-based Envoy decision AND a backend that strips semicolon matrix parameters per segment (e.g., Apache Tomcat / servlet backends), which is a specific dual deployment condition, so real-world exploitability is narrower than AC:L implies (my adjusted score ~3.7). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so the exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed in-the-wild activity. The signals are internally consistent (bounded impact, config-gated), so this is a real but conditional issue: prioritize where Envoy fronts Tomcat/servlet backends and enforces path-based authorization, and deprioritize elsewhere. Note the CWE-289 (Authentication Bypass by Alternate Name) framing overstates it slightly - the practical effect is authorization/path-policy bypass, not credential-level authentication bypass. |
| Exploit ScenarioDerived | An Envoy proxy fronts an Apache Tomcat (or other servlet) backend and enforces a path-based rule that protects, say, /admin while routing unmatched paths to an unprotected fallback. A remote unauthenticated attacker sends a request such as /admin;x=1 (or places a matrix parameter on an earlier segment); Envoy's raw-path matching selects the unprotected fallback while Tomcat strips the per-segment parameter and resolves the protected /admin resource, granting the attacker access to protected content. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Path-confusion access-control bypass in Envoy Proxy before versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 allows remote, unauthenticated clients to reach resources that a path-based Envoy policy (path-based route selection or path-based authorization) intended to protect. Envoy matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource, so a request like /admin;x=1 is matched by Envoy against an unprotected fallback route while the backend still serves the protected resource; Envoy's legacy ignore_path_parameters_in_path_matching option only truncates at the first semicolon and does not reproduce per-segment backend behavior. Exploitation is conditional (it requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment) and the assessed impact is limited to Low confidentiality with no integrity or availability effect; no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Envoy Proxy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 according to your release train (advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x; fix commits include 50f7bfa48dccfee339822e9846b2b8053e07d325 and b205d1f4982e14ce5693ba94ef84d37e7155e050). The fix is controlled by the runtime guard envoy.reloadable_features.strip_path_parameters_per_segment, which must remain enabled (its default) - do not set it to false, and do not re-enable legacy semicolon-truncation behavior via ignore_path_parameters_in_path_matching, because both restore the vulnerable matching semantics. If immediate upgrade is not possible, the most direct compensating control is to reject or normalize requests whose raw path contains a ';' before routing, implemented as an Envoy route/header-matcher or WAF deny rule on the ';' character in the :path header; the trade-off is that legitimate RFC 3986 matrix-parameter traffic (session IDs in URLs, some REST and Java frameworks) will break, so scope the rule to the specific protected prefixes if possible. A narrower alternative is to stop relying on Envoy for the affected authorization decisions and enforce the matching policy at the backend or an upstream layer that performs identical per-segment normalization, at the cost of duplicating policy and possible drift; note that path-rewrite and redirect routes must be reviewed as well, since mismatched post-rewrite matching contributed to the defect. No vendor-released patch is needed for backends themselves, but Tomcat and similar servlet containers should be inventoried so that all paths where an Envoy path decision fronts a semicolon-stripping backend are identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a path-normalization differential, classified as CWE-289 (Authentication Bypass by Alternate Name): two components interpret the same URI differently, so an authorization or routing decision made on one representation does not hold for the other. RFC 3986 section 3.3 permits path parameters (matrix parameters) introduced by ';' within individual path segments, and Servlet-container backends such as Apache Tomcat remove those parameters segment-by-segment before mapping the request to a resource. Envoy, prior to the fix, matched the raw request path, so '/admin;x=1' or '/;x=1/admin' resolves on the backend to the protected '/admin' resource while Envoy's path matcher sees a different string and selects an unprotected fallback route. The specific option ignore_path_parameters_in_path_matching was intended to bridge this gap but only truncates the path at the first semicolon, leaving the per-segment semantics of the backend unmatched. The upstream fix (commits referenced from the GitHub security advisory GHSA-m745-gh6x-349x) adds Http::PathUtil::removePathParameters, which walks the path portion before the query/fragment, tracks an 'in_parameter' state reset at each '/', and drops everything from each ';' to the next '/', returning std::nullopt when no semicolon is present; RouteEntryImplBase::sanitizePathBeforePathMatching and the prefix, path, and regex route entries were reworked to consume this optional sanitized path. The behavior is gated behind the runtime guard envoy.reloadable_features.strip_path_parameters_per_segment, which defaults to stripping per segment but can be set to false to restore the old, vulnerable truncation. Per the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, the attack is network-reachable and unauthenticated but requires the specific deployment combination described above.
Know when Envoy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote and unauthenticated (AV:N/PR:N/UI:N), but AC:H because it needs both a path-based Envoy policy and a per-segment-stripping backend; only Low confidentiality bypass, no I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Same weakness CWE-289 – Authentication Bypass by Alternate Name
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB