CVE-2021-29492: Envoy proxy path normalization bypass via escaped slashes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.3 with network reachability, no authentication, scope change and a very high EPSS percentile make this a serious access-control bypass despite no KEV listing.

What it is

Envoy versions 1.18.2 and earlier do not decode escaped slash sequences %2F and %5C in HTTP URL paths. A remote attacker can craft paths such as /something%2F..%2Fadmin so that Envoy's URL-path-based access control sees a different path than the backend, which may decode and normalize the path and grant access beyond policy. This matters because RBAC or JWT filters enforcing on URL path can be bypassed when the backend treats %2F and / (or %5C and \) interchangeably.

Impact

An unauthenticated remote attacker can reach backend resources that the Envoy access control policy intended to block, gaining access beyond the scope defined by RBAC or JWT path rules. The CVSS vector indicates low confidentiality, integrity and availability impact with scope change.

Attack surface

Reached over the network by sending HTTP requests with escaped slash sequences in the URL path; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Only deployments using URL-path-based access control with backends that normalize %2F and / or %5C and \ interchangeably are affected.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.66214 (99.2nd percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade Envoy to 1.18.3, 1.17.3, 1.16.4 or 1.15.5, which add a path normalization option to decode escaped slash characters.
• Enable the new escaped-slash decoding path normalization option after upgrading.
• If patching is not possible, reconfigure backend servers to stop treating %2F and / and %5C and \ interchangeably.
• Review RBAC and JWT filter policies that enforce on URL path and confirm they are not relying on Envoy's pre-patch normalization behavior.

Detection

• Search proxy and backend access logs for URL paths containing %2F, %5C or mixed encoded slash sequences, especially followed by .. or admin paths.
• Alert on requests where the path seen by Envoy differs from the normalized path logged by the backend.
• Monitor for access to restricted paths such as /admin from clients that would otherwise be blocked by RBAC or JWT path rules.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.