Path-based Authorization Bypass in Envoy Proxy by Envoy Proxy
CVE-2026-73553
7.5HIGH
What is CVE-2026-73553?
Envoy Proxy is vulnerable due to a flaw in its routing mechanism when the ignore_path_parameters_in_path_matching setting is enabled. An improper handling of semicolon suffixes allows unauthorized users to access protected routes, leveraging the discrepancy in canonicalization between the router's matching process and the RBAC url_path matcher. Specifically, requests designed to target /admin;x can bypass a DENY rule meant for /admin, raising significant security concerns. This vulnerability is rectified in subsequent updates: versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4