CVE-2026-73552
Received Received - Intake

HTTP RBAC Bypass in Envoy Proxy

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibited marker and add an unrelated obs-text octet, causing RE2::FullMatch to return false and a negative RBAC policy to treat the invalid subject as an ordinary no-match. A byte-oriented route matcher can still observe the marker, allowing the request to reach a route intended to be denied. The relevant scope boundary is that plain positive ALLOW regexes normally fail closed, and exact, prefix, suffix, and contains matchers are not shown to have this subject-domain failure. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-73552
EUVD
EUVD-2026-84104

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
envoy envoy to 1.36.10 (inc)
envoy envoy to 1.37.6 (inc)
envoy envoy to 1.38.4 (inc)
envoy envoy to 1.39.1 (inc)
envoyproxy envoy to 1.40.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Envoy is a proxy that uses HTTP RBAC for access control. Before versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1, it incorrectly handled opaque header bytes in RBAC policies. A client could bypass restrictions by adding a specific byte to a forbidden header, making RE2 regex evaluations fail to detect the violation. This allowed requests to reach routes meant to be blocked.

Detection Guidance

To detect this vulnerability, check the Envoy version in use with `envoy --version`. If it is below 1.36.10, 1.37.6, 1.38.4, or 1.39.1, the system is vulnerable. Inspect RBAC policies for regex patterns using `safe_regex` and verify if they handle non-UTF-8 headers correctly.

Impact Analysis

This vulnerability could allow unauthorized access to protected routes or resources. Attackers might exploit it to bypass security controls, potentially accessing sensitive data or services they should not be permitted to reach. The impact depends on the RBAC policies in place.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data by bypassing access controls, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy).

Mitigation Strategies

Upgrade Envoy to a patched version (1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later) to address the HTTP RBAC issue with RFC-valid opaque header bytes and RE2 UTF-8 semantics.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart