VulnSocial

CVE-2026-73552Disclosure(envoyproxy / envoy)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch envoyproxy envoy systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibited marker and add an unrelated obs-text octet, causing RE2::FullMatch to return false and a negative RBAC policy to treat the invalid subject as an ordinary no-match. A byte-oriented route matcher can still observe the marker, allowing the request to reach a route intended to be denied. The relevant scope boundary is that plain positive ALLOW regexes normally fail closed, and exact, prefix, suffix, and contains matchers are not shown to have this subject-domain failure. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

envoyproxy CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • envoy

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
envoyproxy
Products
envoy

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-22: 1Mentions · 2026-10-17: 1Patch / Workaround · 2026-10-17: 1Technical Details · 2026-09-22: 1Technical Details · 2026-10-17: 109-2210-17
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-221
Disclosure1
2026-10-171
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-73552 Envoy RBAC policy bypass via malformed header bytes, CVSS 7.5. Fixed in 1.36.10, 1.37.6, 1.38.4, 1.39.1. Patch now. https://www.valtersit.com/cve/CVE-2026-73552/ #CVE #infosec #Envoy #Envoyproxy #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses CVE-2026-73552 (Envoy RBAC policy bypass via malformed header bytes, CVSS 7.5) with technical details and explicitly directs users to patch to fixed versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

    0000049
    1.1K followersView on X
  • NewNormal Security@NewScanTeam
    Disclosure

    NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 22 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: ✂️ Edge proxy path confusion and upgrade tunnelling — smuggle a request past the proxy's own access control (Envoy CVE-2026-73548, CVE-2026-73552, CVE-2026-73553, CVE-2026-73511, CVE-2026-73551) 🖥️ Service mesh proxy admin console reachable with no password — dump upstreams, listeners and the TLS material they reference (Envoy CVE-2026-73546) 📦 Network monitoring appliance on an unpatched build — read its stored config backups, or run commands on the box that sees every flow (ntop ntopng CVE-2026-84990, CVE-2026-82412) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #RequestSmuggling #CSO #REDTEAM

    Post summary

    This is a daily CVE disclosure report from NewNormal Security announcing new vulnerability detections for Envoy and ntopng CVEs, describing technical findings (path confusion, admin access, command execution) without referencing PoCs, exploit tools, patches, or active exploitation.

    0000047
    6 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appenvoyproxyenvoy---

Explore more

Back to dashboardenvoyproxy CVEsenvoy vulnerabilities