VulnSocial

CVE-2026-73546Disclosure(envoyproxy / envoy)

LOWCVSS 7.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch envoyproxy envoy systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

envoyproxy CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • envoy

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
envoyproxy
Products
envoy

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-22: 1Mentions · 2026-10-18: 1Patch / Workaround · 2026-10-18: 1Technical Details · 2026-09-22: 1Technical Details · 2026-10-18: 109-2210-18
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-221
Disclosure1
2026-10-181
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-73546 Envoy proxy CVSS 7.4. Unescaped stat names in /stats?format=html let attacker-controlled data inject stored XSS via grpc_stats. Patch to 1.36.10, 1.37.6, 1.38.4 or 1.39.1 now. https://www.valtersit.com/cve/CVE-2026-73546 #Envoy #infosec #CVE #Envoyproxy #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses CVE-2026-73546, a stored XSS vulnerability in Envoy proxy (CVSS 7.4), and explicitly directs users to patch to fixed versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1.

    0000041
    1.1K followersView on X
  • NewNormal Security@NewScanTeam
    Disclosure

    NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 22 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: ✂️ Edge proxy path confusion and upgrade tunnelling — smuggle a request past the proxy's own access control (Envoy CVE-2026-73548, CVE-2026-73552, CVE-2026-73553, CVE-2026-73511, CVE-2026-73551) 🖥️ Service mesh proxy admin console reachable with no password — dump upstreams, listeners and the TLS material they reference (Envoy CVE-2026-73546) 📦 Network monitoring appliance on an unpatched build — read its stored config backups, or run commands on the box that sees every flow (ntop ntopng CVE-2026-84990, CVE-2026-82412) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #RequestSmuggling #CSO #REDTEAM

    Post summary

    The post announces daily CVE detections added to the NewScan scanner, detailing multiple vulnerabilities in Envoy (request smuggling, unauthenticated admin access) and ntopng (config backup exposure, command execution) with technical descriptions but no exploit code, PoC, patch details, or active exploitation claims.

    0000047
    6 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appenvoyproxyenvoy---

Explore more

Back to dashboardenvoyproxy CVEsenvoy vulnerabilities