CVE-2026-73553

Received Received - Intake

Authorization Bypass in Envoy Proxy via Path Matching

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-73553

EUVD

EUVD-2026-84120

Affected Vendors & Products

Vendor	Product	Version / Range
envoy	envoy	to 1.36.10 (inc)
envoy	envoy	to 1.37.6 (inc)
envoy	envoy	to 1.38.4 (inc)
envoy	envoy	to 1.39.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

This vulnerability affects Envoy, a cloud-native proxy. When a specific setting is enabled, Envoy removes semicolon suffixes from paths before matching routes but not before checking authorization rules. This inconsistency allows requests like /admin;x to bypass path-based access controls meant to protect /admin.

Detection Guidance

To detect this vulnerability, check if your Envoy version is prior to 1.36.10, 1.37.6, 1.38.4, or 1.39.1. Use the command 'envoy --version' to verify the installed version. If vulnerable, inspect configurations for routes with ignore_path_parameters_in_path_matching enabled and RBAC rules that may be bypassed by semicolon-separated paths.

Impact Analysis

An unauthenticated attacker could exploit this to access restricted paths by appending semicolons and suffixes to URLs. This bypasses authorization checks, potentially exposing sensitive backend services or data.

Mitigation Strategies

Upgrade Envoy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. If upgrading is not immediately possible, disable the ignore_path_parameters_in_path_matching option in your Envoy configuration to prevent path parameter stripping that enables the bypass.

Hi! I’m here to help you understand CVE-2026-73553. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70