CVE-2026-26308
Received Received - Intake
RBAC Bypass via HTTP Header Concatenation in Envoy Proxy

Publication date: 2026-03-10

Last updated on: 2026-03-11

Assigner: GitHub, Inc.

Description
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-11
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-14
NVD
CVE-2026-26308
EUVD
EUVD-2026-10798
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
envoyproxy envoy to 1.34.13 (exc)
envoyproxy envoy From 1.35.0 (inc) to 1.35.8 (exc)
envoyproxy envoy From 1.36.0 (inc) to 1.36.5 (exc)
envoyproxy envoy 1.37.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Envoy RBAC (Role-Based Access Control) filter prior to versions 1.37.1, 1.36.5, 1.35.8, and 1.34.13. The issue is in how Envoy validates HTTP headers when multiple values are present for the same header name. Instead of checking each header value individually, Envoy concatenates all values into a single comma-separated string. This allows attackers to bypass RBAC policies, especially "Deny" rules, by sending duplicate headers that obscure the malicious value from exact-match checks.

Impact Analysis

This vulnerability can allow attackers to bypass security policies enforced by Envoy's RBAC filter. Specifically, attackers can circumvent "Deny" rules by exploiting the way Envoy processes multiple header values, potentially gaining unauthorized access or performing actions that should be blocked. This can lead to compromised confidentiality and integrity of the system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Envoy to one of the fixed versions: 1.37.1, 1.36.5, 1.35.8, or 1.34.13.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26308. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart