Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-73551

CVE-2026-73551: Envoy Proxy Path Traversal Vulnerability

CVE-2026-73551 is a path traversal vulnerability in Envoy proxy that allows attackers to bypass security policies through semicolon parameters in URL paths. This article covers the technical details, affected versions, and mitigation.

Published:

CVE-2026-73551 Overview

CVE-2026-73551 is a URL normalization flaw in Envoy, the open source edge and service proxy widely deployed in cloud-native environments. Envoy's path canonicalization does not recognize dot (.) and dot-dot (..) segments when they carry semicolon path parameters. A request such as /user/..;foo=bar/admin is not collapsed to /admin even when path normalization is enabled. When an upstream service interprets the segment per RFC 3986 while Envoy applies routing or Role-Based Access Control (RBAC) to the uncollapsed path, a remote attacker can trigger path confusion and bypass path-based security policies. The issue is classified as [CWE-647] Use of Non-Canonical URL Paths for Authorization Decisions.

Critical Impact

Unauthenticated remote attackers can bypass path-based RBAC and routing policies enforced by Envoy, potentially reaching restricted upstream endpoints such as /admin.

Affected Products

  • Envoy versions prior to 1.36.10
  • Envoy versions prior to 1.37.6
  • Envoy versions prior to 1.38.4 and 1.39.1

Discovery Timeline

  • 2026-09-21 - CVE-2026-73551 published to NVD
  • 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-73551

Vulnerability Analysis

Envoy's normalize_path feature is intended to collapse dot and dot-dot segments before routing and policy decisions run. The normalization logic, however, only matches bare /. and /.. segments. Segments that carry semicolon-delimited path parameters, such as /..;foo=bar or /.;x=1, are not recognized as relative traversal segments. Envoy therefore treats these as opaque path components and leaves them in the request URI when applying routing or RBAC decisions.

Many upstream servers follow RFC 3986 and strip path parameters before resolving relative segments. The upstream then interprets /user/..;foo=bar/admin as /admin. This split interpretation between proxy and origin is the classic definition of a path confusion vulnerability and produces an authorization bypass whenever Envoy is the enforcement point.

Root Cause

The root cause resides in source/common/http/path_utility.cc. The path normalization routine failed to strip URL path parameters from dot and dot-dot segments before canonicalization. As a result, segments beginning with /..; or /.; bypassed the collapse logic entirely.

Attack Vector

An attacker crafts an HTTP request over the network with a URI that embeds a dot-dot segment carrying a path parameter. No authentication or user interaction is required. If Envoy is configured with path-based RBAC or route matching, the attacker can reach upstream paths that policy would otherwise block.

text
# Example request illustrating the path confusion pattern
GET /user/..;foo=bar/admin HTTP/1.1
Host: target.example.com

# Envoy sees the path as: /user/..;foo=bar/admin (RBAC matches /user/*)
# Upstream resolves the path as: /admin (RFC 3986 parameter stripping)

Source: Envoy Security Advisory GHSA-2w8w-rfw7-8gg4

Detection Methods for CVE-2026-73551

Indicators of Compromise

  • HTTP request URIs containing /..; or /.; sequences reaching Envoy listeners.
  • Access log entries where the Envoy-recorded path differs structurally from the upstream-logged path for the same request ID.
  • Successful responses to sensitive endpoints (for example /admin, /internal) originating from clients that lack matching RBAC principals.

Detection Strategies

  • Parse Envoy access logs for the regex pattern /\.\.?; in :path values and alert on matches.
  • Correlate Envoy request IDs across proxy and upstream logs to identify path interpretation mismatches.
  • Review RBAC audit trails for permitted requests whose upstream response indicates access to a resource outside the matched policy scope.

Monitoring Recommendations

  • Enable structured access logging on all Envoy listeners with the full raw :path header captured before and after normalization.
  • Monitor Envoy release channels and subscribe to the Envoy security advisories feed for related URL-parsing issues.
  • Baseline the rate of requests containing semicolon path parameters and alert on statistically significant increases.

How to Mitigate CVE-2026-73551

Immediate Actions Required

  • Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on the deployed release branch.
  • Confirm the normalize_path HTTP connection manager option is enabled so the patched behavior takes effect.
  • Audit RBAC and route configuration for path-based rules that could be bypassed by traversal segments.

Patch Information

The fix is committed across the maintained branches. See Envoy commit 28b6d60, commit d40a68b, commit e9d6c32, and commit f74d110. Fixed releases are available at v1.36.10, v1.37.6, v1.38.4, and v1.39.1. The patch strips URL path parameters from dot and dot-dot segments prior to canonicalization when normalize_path is enabled.

text
# Patch summary from changelogs/current/bug_fixes/url_normalization__collapse_dotdot_segments_with_parameters.rst
Fixes CVE-2026-73551

Strip URL path parameters from dot and dotdot segments (segments
that start with /..; or /.;). This allows path canonicalization to
interpret them correctly. Stripping of path parameters from dot and
dotdot segments occurs only if the normalize_path configuration
option is enabled.

This behavioral change can be temporarily reverted by setting runtime
guard envoy.reloadable_features.strip_dotdot_segments_with_parameters
to false.

Source: Envoy commit 28b6d60

Workarounds

  • Reject requests containing /..; or /.; at an upstream Web Application Firewall (WAF) or ingress layer until Envoy is patched.
  • Where feasible, move authorization decisions to the upstream service so the proxy and origin evaluate the same canonical path.
  • After upgrading, leave the runtime flag envoy.reloadable_features.strip_dotdot_segments_with_parameters at its default true value; do not revert it.
bash
# Verify the runtime guard is enabled (default) after upgrade
curl -s http://127.0.0.1:9901/runtime | \
  grep strip_dotdot_segments_with_parameters

# Ensure normalize_path is enabled in the HTTP connection manager config
# http_connection_manager:
#   normalize_path: true
#   merge_slashes: true

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne