CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NCVE-2026-26308
High (8.2) in envoyproxy envoy. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/envoyproxy/envoy 1.34.13, 1.35.9, 1.36.5.
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- envoyproxy:envoy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ghc4-35x6-crw5 | Go | github.com/envoyproxy/envoy | >=1.37.0 <1.37.1 | 1.37.1 |
| GHSA-ghc4-35x6-crw5 | Go | github.com/envoyproxy/envoy | >=1.36.0 <1.36.5 | 1.36.5 |
| GHSA-ghc4-35x6-crw5 | Go | github.com/envoyproxy/envoy | >=1.35.0 <1.35.9 | 1.35.9 |
| GHSA-ghc4-35x6-crw5 | Go | github.com/envoyproxy/envoy | <1.34.13 | 1.34.13 |