Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-46821
CVE-2025-46821:
Envoy vulnerability analysis and mitigation
Overview
Envoy, a cloud-native edge/middle/service proxy, has been identified with a vulnerability (CVE-2025-46821) affecting versions prior to 1.34.1, 1.33.3, 1.32.6, and 1.31.8. The vulnerability was disclosed on May 7, 2025, and involves incorrect handling of URI template matching where the * character is improperly excluded from valid characters in the URI path (GitHub Advisory).
Technical details
The vulnerability stems from Envoy's URI template matcher incorrectly excluding the * character from the set of valid characters in the URI path. This implementation flaw causes URI paths containing the * character to fail to match URI template expressions. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).
Impact
The primary impact of this vulnerability is the potential bypass of RBAC (Role-Based Access Control) rules when configured using the uri_template permissions. This could lead to unauthorized access to resources that should be protected by RBAC policies (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been fixed in Envoy versions v1.34.1, v1.33.3, v1.32.6, and v1.31.8. For users unable to upgrade immediately, a workaround is available: configure additional RBAC permissions using url_path with safe_regex expression (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management