CVE-2025-46821: 
Envoy vulnerability analysis and mitigation

Envoy, a cloud-native edge/middle/service proxy, was identified with a vulnerability (CVE-2025-46821) disclosed on May 7, 2025. The vulnerability affects versions prior to 1.34.1, 1.33.3, 1.32.6, and 1.31.8, where Envoy's URI template matcher incorrectly excludes the * character from valid characters in the URI path (NVD, Wiz).

The vulnerability stems from an implementation flaw in Envoy's URI template matcher that incorrectly excludes the * character from the set of valid characters in the URI path. This causes URI paths containing the * character to fail to match URI template expressions. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD, Wiz).

The primary impact of this vulnerability is the potential bypass of RBAC (Role-Based Access Control) rules when configured using the uri_template permissions. This could lead to unauthorized access to resources that should be protected by RBAC policies (Wiz).

The vulnerability has been fixed in Envoy versions v1.34.1, v1.33.3, v1.32.6, and v1.31.8. For users unable to upgrade immediately, a workaround is available: configure additional RBAC permissions using urlpath with saferegex expression (NVD, Wiz).