Logic Vulnerability in Envoy Proxy's Role-Based Access Control
CVE-2026-26308
7.5HIGH
What is CVE-2026-26308?
Envoy, a high-performance edge service proxy, has a vulnerability in its Role-Based Access Control (RBAC) feature that relates to how it processes HTTP headers. Prior to versions 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the RBAC filter did not validate multiple header values correctly. Instead of assessing each value separately, it combined them into a single string. This error allows adversaries to manipulate access control measures by sending duplicate headers, which can obscure harmful payloads from standard matching rules, thereby circumventing the intended security policies of Envoy's RBAC system.
Affected Version(s)
envoy >= 1.37.0, < 1.37.1 < 1.37.0, 1.37.1
envoy >= 1.36.0, < 1.36.5 < 1.36.0, 1.36.5
envoy >= 1.35.0, < 1.35.9 < 1.35.0, 1.35.9