Cross-Site Scripting Vulnerability in Envoy Service Proxy
CVE-2026-73546
What is CVE-2026-73546?
Envoy, the open-source edge and service proxy tailored for cloud-native applications, contains a cross-site scripting vulnerability in its /stats?format=html admin endpoint. In versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, the implementation allows potential attackers to craft malicious statistic names through components like grpc_stats. When these names are viewed in the HTML stats interface, they can execute scripts in the context of the admin interface's origin, posing risks of unauthorized access and actions. This vulnerability emphasizes the importance of updating to patched versions to secure your environment against such attacks.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4