VulnSocial

CVE-2026-73553Disclosure(envoyproxy / envoy)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch envoyproxy envoy systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

envoyproxy CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-436

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • envoy

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
envoyproxy
Products
envoy

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-22: 1Mentions · 2026-10-17: 1Patch / Workaround · 2026-10-17: 1Technical Details · 2026-09-22: 1Technical Details · 2026-10-17: 109-2210-17
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-221
Disclosure1
2026-10-171
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-73553 Envoy RBAC bypass: semicolon path mismatch lets unauthenticated requests reach protected backends. CVSS 7.5. Patched in 1.36.10, 1.37.6, 1.38.4, 1.39.1. Patch now. https://www.valtersit.com/cve/CVE-2026-73553 #CVE #infosec #Envoy #Envoyproxy #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text discloses CVE-2026-73553, an Envoy RBAC bypass (CVSS 7.5), with primary focus on available patches and an explicit call to update immediately.

    0000045
    1.1K followersView on X
  • NewNormal Security@NewScanTeam
    Disclosure

    NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 22 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: ✂️ Edge proxy path confusion and upgrade tunnelling — smuggle a request past the proxy's own access control (Envoy CVE-2026-73548, CVE-2026-73552, CVE-2026-73553, CVE-2026-73511, CVE-2026-73551) 🖥️ Service mesh proxy admin console reachable with no password — dump upstreams, listeners and the TLS material they reference (Envoy CVE-2026-73546) 📦 Network monitoring appliance on an unpatched build — read its stored config backups, or run commands on the box that sees every flow (ntop ntopng CVE-2026-84990, CVE-2026-82412) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #RequestSmuggling #CSO #REDTEAM

    Post summary

    The post announces new CVEs in Envoy and ntopng with technical impact details and promotes NewScan for detection, but does not reference PoCs, exploits, patches, or active exploitation.

    0000047
    6 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appenvoyproxyenvoy---

Explore more

Back to dashboardenvoyproxy CVEsenvoy vulnerabilities