CVE-2026-73546
Received Received - Intake

XSS in Envoy Proxy Admin Stats Page

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-73546
EUVD
EUVD-2026-84114

Affected Vendors & Products

Showing 13 associated CPEs
Vendor Product Version / Range
envoy envoy 1.36.10
envoy envoy 1.37.6
envoy envoy 1.38.4
envoy envoy 1.39.1
envoy envoy to 1.36.10 (exc)
envoy envoy to 1.37.6 (exc)
envoy envoy to 1.38.4 (exc)
envoy envoy to 1.39.1 (exc)
envoyproxy envoy 1.36.10
envoyproxy envoy 1.37.6
envoyproxy envoy 1.38.4
envoyproxy envoy 1.39.1
envoyproxy envoy to 1.40.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73546 is a stored cross-site scripting (XSS) vulnerability in Envoy Proxy's admin interface. It occurs because the /stats?format=html endpoint does not properly sanitize stat names before rendering them in HTML. Attackers can inject malicious JavaScript into stat names via components like grpc_stats with stats_for_all_methods enabled. When an admin views the HTML stats page, the injected script executes in the admin interface's context, allowing unauthorized actions.

Detection Guidance

Check Envoy version with `envoy --version` to see if it is below 1.36.10, 1.37.6, 1.38.4, or 1.39.1. Inspect the /stats?format=html endpoint for unsanitized stat names containing HTML special characters like <, >, or &.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of the Envoy admin interface. This could lead to unauthorized actions such as terminating the Envoy process via /quitquitquit or modifying runtime settings. The impact depends on the admin's privileges and whether the admin interface is accessible.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized script execution in the admin interface. Attackers could inject malicious scripts via stat names, potentially accessing or modifying sensitive data, which violates confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Envoy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. If upgrading is not possible, enable the runtime guard `envoy.reloadable_features.sanitize_html_stats_names` to sanitize stat names in HTML output.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart