CVE-2026-73552: Envoy Proxy Auth Bypass Vulnerability

CVE-2026-73552 Overview

Envoy is an open source edge and service proxy widely used in cloud-native architectures and service meshes. A vulnerability in the HTTP Role-Based Access Control (RBAC) filter allows downstream clients to bypass negative RBAC policies that rely on safe_regex header matchers. The issue arises because Envoy accepts RFC-valid opaque header bytes but evaluates safe_regex values using RE2's UTF-8 subject semantics. An attacker can craft a header containing a prohibited marker plus an unrelated obs-text octet, causing RE2::FullMatch to return false while a byte-oriented route matcher still observes the marker. This allows requests to reach routes that were intended to be denied. The flaw is tracked under [CWE-20: Improper Input Validation].

Critical Impact
Attackers can bypass Envoy HTTP RBAC deny policies that use safe_regex header matchers and reach protected routes without authorization.

Affected Products

Envoy proxy versions prior to 1.36.10
Envoy proxy versions prior to 1.37.6
Envoy proxy versions prior to 1.38.4 and 1.39.1

Discovery Timeline

2026-09-21 - CVE-2026-73552 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-73552

Vulnerability Analysis

The vulnerability affects Envoy's HTTP RBAC filter when policies use safe_regex matchers to evaluate request headers. Envoy compiles safe_regex expressions through Google's RE2 library with default UTF-8 subject semantics. HTTP header values, however, are byte strings that may contain RFC-valid obs-text octets outside the ASCII range. When RE2 processes a header value containing invalid UTF-8, RE2::FullMatch returns false regardless of whether the pattern would otherwise match. This creates a semantic mismatch between how the RBAC filter evaluates the header and how downstream byte-oriented route matchers interpret the same value.

A negative (deny) RBAC policy that relies on a regex match to identify prohibited requests will therefore treat a crafted header as a benign no-match. The request then reaches a route matcher that operates on raw bytes and forwards the request to the restricted upstream. Positive ALLOW regexes fail closed under the same condition, as do exact, prefix, suffix, and contains matchers, which limits the scope to negative policies built on safe_regex.

Root Cause

The root cause is a charset mismatch between the regex evaluator and the underlying HTTP protocol. RE2 was initialized with UTF-8 encoding, but HTTP header byte semantics are closer to Latin1. Any header value carrying non-UTF-8 bytes is silently rejected by the regex engine even when the pattern targets those bytes.

Attack Vector

Exploitation is network-based, requires no authentication, and no user interaction. An attacker sends an HTTP request in which a header contains the prohibited marker plus an additional obs-text octet crafted to break UTF-8 validity. The RBAC deny rule fails to match, and the request proceeds to a route that the policy was meant to protect.

text

+Fix CVE-2026-73552
+
+Switch safe_regex charset mode from UTF-8 to Latin1. HTTP headers are not UTF-8 encoded
+and must use Latin1 charset for regex expressions.
+This behavioral change can be temporarily reverted by setting runtime
+guard ``envoy.reloadable_features.re2_use_latin1_mode`` to ``false``.

Source: Envoy commit 5650cb9

The corresponding change in source/common/common/regex.cc initializes RE2 with Latin1 encoding when the runtime feature is enabled:

cpp

namespace Envoy {
namespace Regex {

namespace {

RE2::Options initRe2Options() {
  RE2::Options options(RE2::CannedOptions::Quiet);
  if (Runtime::runtimeFeatureEnabled("envoy.reloadable_features.re2_use_latin1_mode")) {
    options.set_encoding(RE2::Options::EncodingLatin1);
  }
  return options;
}

} // namespace

Source: Envoy commit 5650cb9

Detection Methods for CVE-2026-73552

Indicators of Compromise

HTTP requests containing header values with non-ASCII obs-text octets (bytes 0x80-0xFF) reaching routes normally protected by an RBAC deny policy.
Access log entries showing successful requests to restricted upstreams from principals that should have been denied by RBAC safe_regex rules.
Discrepancies between RBAC filter decisions and route match results for the same header value.

Detection Strategies

Audit Envoy configurations for rbac filters that use safe_regex header matchers in deny policies and flag any that also rely on byte-oriented route matchers for the same header.
Compare request headers against RE2 UTF-8 validity to identify traffic crafted to defeat the matcher.
Correlate authentication and authorization outcomes at the application layer with Envoy access logs to surface unauthorized route access.

Monitoring Recommendations

Enable verbose RBAC filter logging (shadow_rules_stat_prefix and per-policy stats) to record allow/deny decisions.
Ingest Envoy access logs into a centralized data lake and alert on non-UTF-8 header bytes on protected paths.
Monitor spikes in requests to restricted routes that previously produced RBAC deny counters.

How to Mitigate CVE-2026-73552

Immediate Actions Required

Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on your release branch.
Ensure the runtime guard envoy.reloadable_features.re2_use_latin1_mode remains at its default enabled value after upgrade.
Review RBAC policies that use safe_regex for header matching and confirm they evaluate correctly against non-UTF-8 header bytes.

Patch Information

The fix switches Envoy's safe_regex charset from UTF-8 to Latin1, aligning regex evaluation with HTTP header byte semantics. See the upstream fixes in Envoy commit 5650cb9, commit 7d1dee5, commit c2b9a19, and commit f372676. Patched releases are available at v1.36.10, v1.37.6, v1.38.4, and v1.39.1. Full advisory: GHSA-23xh-2qxr-3xv8.

Workarounds

Replace safe_regex header matchers in negative RBAC policies with exact, prefix, suffix, or contains matchers, which are not affected.
Add an upstream input-validation layer that rejects HTTP headers containing non-ASCII obs-text octets on sensitive routes.
Do not disable the fix by setting envoy.reloadable_features.re2_use_latin1_mode to false; that revert reintroduces the bypass.

bash

# Ensure the Latin1 runtime feature remains enabled (default after patch)
envoy --config-path envoy.yaml \
  --runtime-feature-override-for-tests envoy.reloadable_features.re2_use_latin1_mode=true