CVE-2026-26308

Received Received - Intake

RBAC Bypass via HTTP Header Concatenation in Envoy Proxy

Publication date: 2026-03-10

Last updated on: 2026-03-11

Assigner: GitHub, Inc.

Description

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-10

Last Modified

2026-03-11

Generated

2026-07-06

AI Q&A

2026-03-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-26308

EUVD

EUVD-2026-10798

Affected Vendors & Products

Vendor	Product	Version / Range
envoyproxy	envoy	to 1.34.13 (exc)
envoyproxy	envoy	From 1.35.0 (inc) to 1.35.8 (exc)
envoyproxy	envoy	From 1.36.0 (inc) to 1.36.5 (exc)
envoyproxy	envoy	1.37.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Envoy RBAC (Role-Based Access Control) filter prior to versions 1.37.1, 1.36.5, 1.35.8, and 1.34.13. The issue is in how Envoy validates HTTP headers when multiple values are present for the same header name. Instead of checking each header value individually, Envoy concatenates all values into a single comma-separated string. This allows attackers to bypass RBAC policies, especially "Deny" rules, by sending duplicate headers that obscure the malicious value from exact-match checks.

Impact Analysis

This vulnerability can allow attackers to bypass security policies enforced by Envoy's RBAC filter. Specifically, attackers can circumvent "Deny" rules by exploiting the way Envoy processes multiple header values, potentially gaining unauthorized access or performing actions that should be blocked. This can lead to compromised confidentiality and integrity of the system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Envoy to one of the fixed versions: 1.37.1, 1.36.5, 1.35.8, or 1.34.13.

Hi! I’m here to help you understand CVE-2026-26308. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70