CVE-2026-73553

high

Envoy is an open source edge and service proxy designed for cloud-native applications.

Vendor / product: Envoyproxy — envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS

7.5

7.5 (CVSS v3.1)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-09-21 21:17

Modified: 2026-10-05 14:08

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 06:54 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

envoyproxy / envoy <1.36.10, ≥1.37.0 <1.37.6, ≥1.38.0 <1.38.4, ≥1.39.0 <1.39.1

Weakness classification (CWE)

CWE-436

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq

Patch / mitigation: https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273

Patch / mitigation: https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6

Patch / mitigation: https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1

Patch / mitigation: https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2

Patch / mitigation: https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq

References

https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273 security-advisories@github.com
https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6 security-advisories@github.com
https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1 security-advisories@github.com
https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2 security-advisories@github.com
https://github.com/envoyproxy/envoy/releases/tag/v1.36.10 security-advisories@github.com
https://github.com/envoyproxy/envoy/releases/tag/v1.37.6 security-advisories@github.com
https://github.com/envoyproxy/envoy/releases/tag/v1.38.4 security-advisories@github.com
https://github.com/envoyproxy/envoy/releases/tag/v1.39.1 security-advisories@github.com
https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq security-advisories@github.com
https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:54 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-73553

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs