CVE-2026-73551: 
Envoy vulnerability analysis and mitigation

CVE-2026-73551 is a URL path normalization bypass vulnerability in Envoy Proxy that allows unauthenticated remote attackers to circumvent path-based routing policies and RBAC rules. The flaw affects Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. It was published on September 21, 2026, with patches released shortly after. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-647 (Use of Non-Canonical URL Paths for Authorization Decisions). Envoy's path canonicalization logic does not recognize dot (.) and dotdot (..) path segments when they carry semicolon-delimited parameters (e.g., ..;foo=bar), as defined in RFC 3986 section 3.3. As a result, a request such as /user/..;foo=bar/admin is not collapsed to /admin even when normalize_path is enabled, creating a mismatch between the path Envoy evaluates for routing/RBAC and the path the upstream service resolves. The fix, implemented in path_utility.cc, adds a stripParametersFromDotSegments() function that strips semicolon parameters from dot/dotdot segments before canonicalization, controlled by the runtime guard envoy.reloadable_features.strip_dotdot_segments_with_parameters (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated network attacker to bypass Envoy's path-based RBAC policies and routing rules, potentially accessing restricted endpoints or resources that should be protected. The confidentiality impact is limited (low), with no direct integrity or availability impact, as the vulnerability enables unauthorized information access rather than data modification or service disruption. The actual severity depends on the sensitivity of the upstream resources protected by path-based policies and the degree of interpretation mismatch between Envoy and the upstream service (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is automatable (no user interaction or privileges required) and exploitable over the network with low attack complexity. The EPSS score is approximately 0.0055 (0.55%), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Reconnaissance: Identify Envoy Proxy deployments (versions < 1.36.10, 1.37.0–1.37.5, 1.38.0–1.38.3, or 1.39.0) acting as edge proxies or API gateways with path-based RBAC or routing policies configured.
2. Identify protected paths: Determine which URL paths are restricted by Envoy's RBAC or routing rules (e.g., /admin, /internal, /api/sensitive).
3. Craft bypass payload: Construct an HTTP request using a semicolon-parameterized dotdot segment to traverse past a path prefix, for example: GET /user/..;foo=bar/admin HTTP/1.1.
4. Send request: Transmit the crafted request to the Envoy listener. Envoy evaluates the uncollapsed path /user/..;foo=bar/admin against its RBAC/routing rules (which may permit it), while the upstream service resolves it as /admin.
5. Access restricted resource: The upstream service processes the request as targeting the restricted path, granting access to resources that Envoy's policy was intended to block (GitHub Advisory, Patch Commit).

• Network: HTTP requests containing path segments matching patterns /..; or /.; (e.g., /user/..;foo=bar/admin, /api/.;v=1/restricted) in access logs targeting sensitive endpoints.
• Logs: Envoy access log entries showing requests with URL paths containing /..; or /.; sequences that result in unexpected upstream responses (e.g., 200 OK) for paths that should be restricted; look for discrepancies between the Envoy-logged path and upstream application logs.
• Application Logs: Upstream service logs showing requests to restricted paths (e.g., /admin, /internal) that do not appear to have been blocked by the proxy layer (GitHub Advisory).

Upgrade Envoy to one of the patched versions: 1.36.10, 1.37.6, 1.38.4, or 1.39.1. As a temporary workaround prior to upgrading, review and audit path-based RBAC and routing policies to account for potential bypass vectors using semicolon-parameterized path segments. If needed, the new behavior can be temporarily reverted by setting the runtime guard envoy.reloadable_features.strip_dotdot_segments_with_parameters to false, though this leaves the vulnerability unmitigated. Ensuring normalize_path is enabled is a prerequisite for the fix to take effect (GitHub Advisory, Patch Commit).