CVE-2026-73553: Envoy Proxy Authentication Bypass Vulnerability

CVE-2026-73553 Overview

CVE-2026-73553 is an authorization bypass vulnerability in Envoy, the open source edge and service proxy for cloud-native applications. When the ignore_path_parameters_in_path_matching route option is enabled, Envoy's router strips the semicolon suffix before route matching. However, the Role-Based Access Control (RBAC) url_path matcher evaluates the raw request path. This inconsistent canonicalization allows an unauthenticated attacker to send a request like /admin;x that bypasses a DENY rule for /admin while still being routed to the protected /admin backend. The issue is fixed in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Critical Impact
Unauthenticated remote attackers can bypass path-based RBAC policies and reach protected upstream services through Envoy proxies with vulnerable configurations.

Affected Products

Envoy versions prior to 1.36.10
Envoy versions prior to 1.37.6 and 1.38.4
Envoy versions prior to 1.39.1

Discovery Timeline

2026-09-21 - CVE-2026-73553 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-73553

Vulnerability Analysis

The vulnerability is an interpretation conflict between two Envoy subsystems [CWE-436]. The router and the RBAC filter apply different canonicalization rules to the same HTTP request path. When operators enable ignore_path_parameters_in_path_matching to normalize routing behavior, the router discards the semicolon path parameter suffix before selecting an upstream cluster. The RBAC url_path matcher, however, continues to evaluate the untransformed raw path.

An attacker who appends an arbitrary path parameter such as ;x to a protected URL produces two different views of the same request. The RBAC filter sees /admin;x and fails to match a DENY rule scoped to /admin. The router strips the suffix and forwards the request to the /admin route's backend cluster. The result is unauthenticated access to a resource that policy explicitly denies.

Root Cause

The root cause is inconsistent path normalization across filter chains. Envoy did not propagate the ignore_path_parameters_in_path_matching route-level setting to the RBAC matcher, so authorization decisions ran against a non-canonical path while routing decisions ran against the canonical form.

Attack Vector

Exploitation requires a network-reachable Envoy listener with two conditions satisfied simultaneously: the route option ignore_path_parameters_in_path_matching must be enabled, and a path-based RBAC rule must protect a route that still matches after suffix stripping. The attacker sends a single crafted HTTP request appending ;<anything> to the protected path. No authentication, credentials, or user interaction are required.

// Patch: envoy/router/router.h - expose the route-level setting to filters
   const Envoy::Config::TypedMetadata& typedMetadata() const PURE;
+
+  /**
+   * @return bool whether to ignore path parameters in path matching.
+   */
+  virtual bool ignorePathParametersInPathMatching() const PURE;
 };

// Patch: source/common/http/null_route_impl.h - default implementation
  bool ignorePathParametersInPathMatching() const override { return false; }

Source: Envoy Commit 0be4a030

Detection Methods for CVE-2026-73553

Indicators of Compromise

HTTP request paths containing a semicolon suffix (for example, /admin;x, /api/v1/users;foo=bar) directed at routes covered by RBAC DENY policies.
Access log entries showing successful 2xx responses to protected upstream clusters from clients that lack authenticated identity.
Divergence between Envoy access log :path values and upstream application access logs recording the canonical path.

Detection Strategies

Audit deployed Envoy configurations for routes that enable ignore_path_parameters_in_path_matching alongside path-based RBAC url_path matchers.
Correlate ingress proxy access logs with upstream service logs to identify requests where authorization was granted but the effective resource was policy-protected.
Deploy negative test cases in CI/CD that replay protected endpoints with ; suffixes and assert HTTP 403 responses.

Monitoring Recommendations

Alert on spikes in requests containing ; characters in the request-target reaching sensitive routes such as admin or management APIs.
Instrument the RBAC filter's denied counter and alert on statistically anomalous drops that could indicate bypass traffic.
Ingest Envoy and upstream logs into a centralized analytics platform to enable cross-layer correlation of authorization outcomes.

How to Mitigate CVE-2026-73553

Immediate Actions Required

Upgrade Envoy to a patched release: 1.36.10, 1.37.6, 1.38.4, or 1.39.1.
Inventory every route configuration and identify combinations of ignore_path_parameters_in_path_matching with path-based RBAC rules.
Review recent proxy logs for exploitation attempts using semicolon-suffixed paths against protected endpoints.

Patch Information

The fix propagates the ignorePathParametersInPathMatching() route-level setting into the RBAC matcher so both routing and authorization operate on the same canonicalized path. See the GitHub Security Advisory GHSA-77x5-xqjg-hprq and release notes for v1.36.10, v1.37.6, v1.38.4, and v1.39.1.

Workarounds

Disable the ignore_path_parameters_in_path_matching route option until the patched Envoy version is deployed.
Enforce path normalization upstream by rejecting requests that contain ; in the path at the ingress or application layer.
Add compensating RBAC rules that also match path patterns including semicolon suffixes (for example, /admin and /admin;.*).

bash

# Verify installed Envoy version and upgrade to a patched release
envoy --version

# Example: pull a patched container image
docker pull envoyproxy/envoy:v1.39.1

# Temporarily disable the affected route option in envoy.yaml
# route:
#   ignore_path_parameters_in_path_matching: false