CVE-2026-73553

🟡 Monitoruj

Obejście autoryzacji w Envoy pozwala nieautoryzowanym klientom uzyskać dostęp do chronionych zasobów.

CVSS
7.5
EPSS
0.5%
Exploit
poc
Vendor
envoyproxy
Opis źródłowy (NVD)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

exploit Brak patcha
Źródła i daty
ŹródłoWartość
NVD – CVSS7.5
CISA KEV (aktywnie wykorzystywane)Nie
FIRST EPSS (prawdopodobieństwo exploita)0.5%
Opublikowano (NVD)2026-09-21 21:17:09 UTC
Ostatnia modyfikacja (NVD)2026-10-05 14:08:59 UTC
Referencje