CVE-2026-47775: Envoyproxy Envoy Auth Bypass Vulnerability

CVE-2026-47775 Overview

CVE-2026-47775 is a padding oracle vulnerability in the Envoy proxy OAuth2 HTTP filter. The encrypt() and decrypt() functions use AES-256-CBC without an authentication tag, providing no HMAC or AEAD verification. The /callback endpoint returns HTTP 302 on successful decryption and HTTP 401 on padding failure, exposing a classic padding oracle. An attacker who obtains the encrypted CodeVerifier cookie can recover the plaintext PKCE code_verifier in approximately 6,200 requests within roughly 100 seconds. The recovered verifier, combined with a stolen authorization code, permits retrieval of the victim's access token.

Critical Impact
Recovery of PKCE code verifiers enables OAuth2 access token theft, breaking the confidentiality and integrity guarantees of the authorization code flow.

Affected Products

Envoy versions prior to 1.35.11
Envoy versions prior to 1.36.7
Envoy versions prior to 1.37.3 and 1.38.1

Discovery Timeline

2026-06-26 - CVE-2026-47775 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-47775

Vulnerability Analysis

Envoy's OAuth2 HTTP filter protects the PKCE code_verifier by storing it in a client-side cookie encrypted with AES-256-CBC. The implementation omits any authentication mechanism, applying neither an HMAC nor an authenticated encryption mode such as AES-GCM. Ciphertext integrity is therefore not verified before decryption. The filter distinguishes decryption outcomes at the HTTP response layer: a valid PKCS#7 padding produces HTTP 302, while invalid padding yields HTTP 401. This differential response exposes the well-known padding oracle side channel described in [CWE-209].

Root Cause

The root cause is the use of unauthenticated CBC-mode encryption combined with distinguishable error responses. Without authentication, an attacker can submit modified ciphertext blocks and observe how the server reacts. Because CBC decryption XORs the previous ciphertext block into the plaintext, targeted bit manipulation of that block lets the attacker probe the padding byte-by-byte. Each recovered byte reveals one plaintext byte of the code_verifier.

Attack Vector

An attacker must first obtain the encrypted CodeVerifier cookie, for example through a network position, a subdomain leak, or client-side exposure. The attacker then issues crafted requests to the Envoy /callback endpoint with modified ciphertext. Each request reveals whether padding is valid based on the 302 or 401 response. The full 43-character PKCE verifier can be recovered in approximately 6,200 requests. Combined with a stolen authorization code, the attacker completes the token exchange and obtains the victim's OAuth2 access token. Refer to the Envoy Security Advisory GHSA-396h-jpq4-vc7p for full technical details.

Detection Methods for CVE-2026-47775

Indicators of Compromise

High-volume request bursts to the OAuth2 /callback endpoint from a single source, typically several thousand requests within a short window.
Elevated ratios of HTTP 401 responses at the /callback path relative to normal baselines.
Requests to /callback carrying malformed or systematically mutated CodeVerifier cookies.

Detection Strategies

Alert on sustained request rates above baseline against OAuth2 callback URIs on Envoy-fronted services.
Correlate 302 and 401 response sequences from the same client IP or session identifier to identify oracle probing patterns.
Inspect access logs for repeated cookie values with incrementally altered ciphertext bytes.

Monitoring Recommendations

Enable structured access logging on Envoy for OAuth2 filter traffic and forward logs to a centralized analytics platform.
Track per-source-IP error rates on /callback and set thresholds for automated blocking.
Monitor OAuth2 identity provider logs for anomalous token exchanges paired with authorization codes issued to different client sessions.

How to Mitigate CVE-2026-47775

Immediate Actions Required

Upgrade Envoy to 1.35.11, 1.36.7, 1.37.3, or 1.38.1 depending on the deployed release branch.
Rotate any secrets used by the OAuth2 filter for cookie encryption to invalidate previously issued CodeVerifier cookies.
Invalidate active OAuth2 sessions if padding oracle probing activity is suspected in access logs.

Patch Information

The Envoy maintainers fixed the vulnerability in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1. The fix removes the padding oracle by moving to authenticated encryption for the OAuth2 filter cookie payload. See the GitHub Security Advisory GHSA-396h-jpq4-vc7p for patch details and commit references.

Workarounds

Restrict access to the OAuth2 /callback endpoint using rate limiting to slow oracle exploitation.
Deploy Web Application Firewall rules that block clients generating abnormal 401 response ratios on OAuth2 endpoints.
Where feasible, disable the Envoy OAuth2 HTTP filter until upgrade to a fixed version is possible.

bash

# Example Envoy rate limit configuration for /callback
http_filters:
  - name: envoy.filters.http.local_ratelimit
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
      stat_prefix: oauth_callback_rl
      token_bucket:
        max_tokens: 10
        tokens_per_fill: 10
        fill_interval: 60s
      filter_enabled:
        default_value:
          numerator: 100
          denominator: HUNDRED
      filter_enforced:
        default_value:
          numerator: 100
          denominator: HUNDRED