CVE-2026-73553: 
Envoy vulnerability analysis and mitigation

CVE-2026-73553 is a path parameter canonicalization authorization bypass vulnerability in Envoy Proxy, an open source edge and service proxy for cloud-native applications. When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips semicolon-delimited path parameters before route matching, but the RBAC url_path matcher evaluates the raw, unstripped path — allowing a request like GET /admin;x to bypass a DENY rule for /admin while still being routed to the protected backend. Affected versions include all releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The vulnerability was disclosed on August 26, 2026, and has a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is an interpretation conflict (CWE-436) between two Envoy components that process the same request path differently. The router's sanitizedPath() function calls stripPathParams() when ignore_path_parameters_in_path_matching is enabled, converting /admin;x to /admin for route matching (source/common/router/config_impl.h:91-96, config_impl.cc:1430). However, the RBAC filter's PathMatcher and UriTemplateMatcher call only Http::PathUtil::removeQueryAndFragment(), which strips query strings and fragments but not semicolon-delimited path parameters, leaving /admin;x intact for policy evaluation (source/extensions/filters/common/rbac/matchers.cc). Three preconditions must be met: ignore_path_parameters_in_path_matching: true must be set in RouteConfiguration, a path-based RBAC url_path policy must be configured, and the protected route must match after parameter stripping. No operator-side configuration (e.g., normalizePath, mergeSlashes) can close this gap in vulnerable versions (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated network attacker to bypass path-based RBAC DENY policies and gain unauthorized access to protected backend services — such as administrative endpoints — without valid credentials. The confidentiality impact is high (scope changed), as the attacker can interact with backend application logic that should be restricted, and there is a low integrity impact from the ability to perform unauthorized actions on the protected service. Availability is not directly impacted. The exploit can serve as an initial access foothold, enabling further privilege escalation or lateral movement within the accessed backend service (GitHub Advisory).

A complete, reproducible proof-of-concept exploit is publicly available in the GitHub Security Advisory, including Envoy configuration files (envoy.yaml) and a Python script (probe.py) that demonstrates the bypass by sending GET /admin;x to trigger the RBAC bypass (GitHub Advisory). The vulnerability requires no authentication and no user interaction, though attack complexity is rated High due to the specific configuration preconditions required. The EPSS score is approximately 0.517%, and there is no evidence of in-the-wild exploitation at this time. The NVD SSVC assessment classifies exploitation status as "poc" with partial technical impact. The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify Envoy proxy deployments (versions prior to 1.36.10, 1.37.6, 1.38.4, or 1.39.1) that are internet-facing or reachable on the network. Confirm the target uses ignore_path_parameters_in_path_matching: true in its route configuration and has path-based RBAC DENY rules protecting specific endpoints (e.g., /admin).
2. Identify protected paths: Probe the Envoy listener (e.g., on port 10000) with direct requests to suspected protected paths (e.g., GET /admin) to confirm a 403 response, indicating an active RBAC DENY rule.
3. Craft bypass request: Append a semicolon and arbitrary characters to the protected path to form a path parameter suffix (e.g., /admin;x, /admin;foo=bar). This is valid HTTP path-parameter syntax per RFC 3986.
4. Send bypass request: Issue GET /admin;x HTTP/1.1 to the Envoy listener. The RBAC filter evaluates the raw path /admin;x, which does not match the exact DENY rule for /admin, so the request is permitted.
5. Router strips parameters and routes to protected backend: The router's sanitizedPath() strips the ;x suffix, matching the /admin route and forwarding the request to the protected admin_backend cluster.
6. Access protected resource: The backend receives the request and responds with a 200 status, confirming the authorization bypass. The attacker can now interact with the protected service (e.g., admin panel, API endpoint) without valid authorization (GitHub Advisory).

• Network: HTTP GET requests to protected paths with semicolon-appended suffixes (e.g., /admin;x, /admin;foo=bar, /api/admin;bypass) arriving at Envoy listeners; unexpected 200 responses from backends for paths that should return 403.
• Logs: Envoy access logs showing entries like GET /admin;x -> route=admin_route cluster=admin_backend code=200 for paths that should be denied; absence of expected 403 log entries for protected paths when semicolon variants are used.
• Logs: Discrepancy between RBAC denial logs (403 for /admin) and successful routing logs (200 for /admin;x) targeting the same backend cluster in the same session or time window.
• Application Logs: Unexpected requests appearing in backend application logs (e.g., admin service logs) with paths containing semicolons (e.g., path=/admin;x), indicating traffic that bypassed the proxy's authorization layer (GitHub Advisory).

Upgrade Envoy to one of the patched versions: 1.36.10, 1.37.6, 1.38.4, or 1.39.1, depending on your current release branch (GitHub Advisory, Patch Commit). The fix makes RBAC PathMatcher and UriTemplateMatcher honor the ignore_path_parameters_in_path_matching setting and strip path parameters before policy evaluation, controlled by the runtime guard envoy.reloadable_features.rbac_respect_ignore_path_parameters. If immediate upgrade is not possible, consider: (1) disabling ignore_path_parameters_in_path_matching if not required; (2) adding supplementary authentication mechanisms or network-level access controls on sensitive endpoints; (3) temporarily reverting the fix behavior by setting the runtime guard to false only if the patch causes compatibility issues. Note that no RBAC configuration change alone can close this gap in vulnerable versions.

The vulnerability was discovered and reported by the Novee Security Research Team, credited in the official GitHub Security Advisory (GitHub Advisory). The advisory was coordinated by Envoy maintainer phlax with remediation review by yanavlasov. The issue was picked up by downstream distributors including AWS (Amazon Linux 2 and AL2023 security advisories) and openSUSE, and detected by Nessus plugin 345786. No significant independent researcher commentary or broad social media discussion has been identified beyond standard vulnerability database aggregation.