CVE-2026-73511
published 2026-09-21CVE-2026-73511: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.38%
30.4th percentile
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | < 1.36.10 | 1.36.10 |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.37.0 < 1.37.6 | 1.37.6 |
| envoyproxy | envoy | >= 1.38.0 < 1.38.4 | 1.38.4 |
| envoyproxy | envoy | >= 1.39.0 < 1.39.1 | 1.39.1 |
| openshift-service-mesh | istio-proxyv2-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Envoy Proxy up to 1.36.9/1.37.5/1.38.3/1.39.0 Path Matching access control
vuldb·2026-09-21·CVSS 5.3
CVE-2026-73511 [MEDIUM] Envoy Proxy up to 1.36.9/1.37.5/1.38.3/1.39.0 Path Matching access control
A vulnerability described as problematic has been identified in Envoy Proxy Envoy up to 1.36.9/1.37.5/1.38.3/1.39.0. This impacts an unknown function of the component Path Matching. The manipulation results in improper access controls.
This vulnerability is reported as CVE-2026-73511. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
Red Hat
envoy: envoy: path matching bypass via per-segment parameters not stripped by router
vendor_redhat·2026-08-26·CVSS 5.3
CVE-2026-73511 [MEDIUM] CWE-706 envoy: envoy: path matching bypass via per-segment parameters not stripped by router
envoy: envoy: path matching bypass via per-segment parameters not stripped by router
No description is available for this CVE.
Package: openshift-service-mesh/istio-proxyv2-rhel9 (OpenShift Service Mesh 3) - Affected
No detection rules found.
No public exploits indexed.
https://github.com/envoyproxy/envoy/commit/26d5https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ffhttps://github.com/envoyproxy/envoy/releases/tag/v1.36.10https://github.com/envoyproxy/envoy/releases/tag/v1.37.6https://github.com/envoyproxy/envoy/releases/tag/v1.38.4https://github.com/envoyproxy/envoy/releases/tag/v1.39.1https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x
2026-09-21
Published