CVE-2026-73511 Overview
CVE-2026-73511 is an access control bypass vulnerability in Envoy, an open source edge and service proxy for cloud-native applications. Envoy matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. The ignore_path_parameters_in_path_matching option truncates at the first semicolon, which still does not align with per-segment backend behavior. A remote attacker can craft a request with parameterized segments to make Envoy select an unprotected fallback route while the backend resolves the protected resource. The issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Critical Impact
Remote unauthenticated clients can bypass path-based authorization policies enforced by Envoy and access protected backend resources.
Affected Products
- Envoy Proxy versions prior to 1.36.10
- Envoy Proxy versions prior to 1.37.6
- Envoy Proxy versions prior to 1.38.4 and 1.39.1
Discovery Timeline
- 2026-09-21 - CVE-2026-73511 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-73511
Vulnerability Analysis
The vulnerability is a URL path normalization inconsistency between Envoy and downstream servlet backends. Envoy applies path-based routing and authorization decisions on the raw request path, or on a path truncated at the first semicolon when ignore_path_parameters_in_path_matching is enabled. Servlet containers such as Apache Tomcat implement RFC 3986 Section 3.3 semantics and strip matrix parameters from each individual path segment before resource resolution.
This parser differential allows a remote client to construct requests that Envoy evaluates against one route while the backend resolves them to a different, protected resource. The flaw is classified as [CWE-289] Authentication Bypass by Alternate Name. The bypass requires both a path-based Envoy authorization decision and a backend that strips semicolon parameters per segment.
Root Cause
The root cause is inconsistent handling of semicolon matrix parameters in path segments. Envoy either preserved the parameters or truncated the path at the first semicolon, whereas RFC 3986 requires per-segment stripping. This mismatch produces divergent path canonicalization between the proxy and the origin server.
Attack Vector
An attacker sends a request containing a semicolon parameter on a protected segment or on an earlier segment in the URL. Envoy's route matcher fails to identify the protected path and routes the request through an unprotected fallback route. The backend strips the matrix parameter per segment and resolves the request to the protected resource, effectively bypassing the Envoy-enforced access control.
+Fixes `CVE-2026-73511 <https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x>`_
+
+Strip path parameters from individual path segments per https://datatracker.ietf.org/doc/html/rfc3986#section-3.3
+
+This behavioral change can be temporarily reverted by setting runtime
+guard ``envoy.reloadable_features.strip_path_parameters_per_segment`` to ``false``.
Source: Envoy Proxy Commit Fix
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-73511
Indicators of Compromise
- HTTP request paths containing semicolon characters (;) within path segments targeting protected URIs.
- Access logs showing successful backend responses for resources that Envoy routed through an unprotected fallback route.
- Discrepancies between Envoy route match logs and backend application access logs for the same request ID.
Detection Strategies
- Correlate Envoy access logs with backend application logs to identify path normalization mismatches.
- Alert on requests containing ; in path segments directed at endpoints protected by path-based authorization rules.
- Baseline legitimate matrix parameter usage and flag anomalous parameterization patterns on sensitive routes.
Monitoring Recommendations
- Enable verbose route match debugging in Envoy for authorization-critical routes during triage.
- Ingest Envoy and backend HTTP logs into a centralized analytics platform for cross-layer correlation.
- Track HTTP 200/2xx responses on protected endpoints preceded by fallback route matches in Envoy.
How to Mitigate CVE-2026-73511
Immediate Actions Required
- Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on the deployed release branch.
- Audit route configurations for path-based authorization rules that depend on exact segment matching.
- Review backend servlet containers such as Apache Tomcat for per-segment matrix parameter stripping behavior.
Patch Information
The fix, tracked in Envoy Security Advisory GHSA-m745-gh6x-349x, strips path parameters from individual path segments per RFC 3986 Section 3.3. The change is implemented in source/common/http/path_utility.cc and can be temporarily reverted via the runtime guard envoy.reloadable_features.strip_path_parameters_per_segment. See the Envoy Proxy Commit Fix for the full patch.
Workarounds
- Deploy a request-rewriting filter that rejects or normalizes requests containing semicolons in path segments before route matching.
- Enforce authorization at the backend application layer in addition to Envoy path-based policies.
- Restrict use of the ignore_path_parameters_in_path_matching option until upgrading to a fixed release.
# Runtime guard to revert to pre-patch behavior (only if upgrade breaks routing)
# Leave this ENABLED (default true) to keep the security fix active
envoy.reloadable_features.strip_path_parameters_per_segment=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
