← Vulnerability feed

Vulnerability record · CVE-2026-73553 · published 21 September 2026

CVE-2026-73553: Interpretation conflict vulnerability

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

7.5 CVSS 3.1 High EPSS 0.52% · top 58.3% CWE-436 · Interpretation conflict Awaiting Analysis
7.5CVSS 3.1 base score
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
10References
23 Sep 2026Last modified by NVD

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

References

LinkTags
https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273
https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6
https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1
https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2
https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq
https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq

Track CVE-2026-73553 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-63030WordPress REST API route confusion leads to SQL injection and RCEWordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 contain a REST API batch endpoint route confusion flaw (CWE-436). Chained with the author__not_in…KEVEPSS 10%analysed8.0CVE-2025-48384Git config CRLF handling allows submodule path link-following code executionGit mishandles trailing carriage returns when writing config values, so a submodule path ending in CR is read back altered during submodule initializ…KEVEPSS 4.1%analysed

Source: NIST National Vulnerability Database (record CVE-2026-73553), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.