Skip to content
fr Sign in
7.5 High

CVE-2026-26308 Envoy is a high-performance edge/middle/service proxy

Description

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

Affected products and versions

Product Affected versions Fixed in
envoy 1.37 1.37.0 → < 1.37.1 1.37.1
envoy 1.36 1.36.0 → < 1.36.5 1.36.5
envoy 1.35 1.35.0 → < 1.35.9 1.35.9
envoy 1.34 earliest → < 1.34.13 1.34.13

References

Timeline

  1. Published
  2. Last modified

Other CVEs of envoy

The 98 CVEs of envoy →
CVE-2026-73511 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73553 Envoy is an open source edge and service proxy designed for cloud-native applications 7.5 High CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applications 7.4 High
Track this CVE