Envoy HTTP RBAC Vulnerability in Open Source Proxy Service
CVE-2026-73552
7.5HIGH
What is CVE-2026-73552?
Envoy, an open-source edge and service proxy, has a vulnerability in its HTTP Role-Based Access Control (RBAC) mechanism. The issue arises from its acceptance of RFC-valid opaque header bytes which could be exploited. When a downstream client manipulates these headers, it may allow unauthorized access by producing a negative match in the RBAC policy evaluation, despite the presence of a prohibited marker. This flaw might enable harmful requests to bypass intended restrictions, presenting security risks for applications reliant on proper access controls. Mitigation is available in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4