Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-73553

Envoy: RBAC Authorization Bypass via Path Parameters

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-73553

Published

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-73553

Published

envoy

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "envoyproxy",
                    "product": "envoy",
                    "versions": [
                        {
                            "version": "< 1.36.10",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.37.0, < 1.37.6",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.38.0, < 1.38.4",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.39.0, < 1.39.1",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON