Description
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
Metrics
CVSS 3.1 8.2/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| envoyproxy | envoy | >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13 |
References
- https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867Patch
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-ghc4-35x6-crw5Exploit, Mitigation, Vendor Advisory
Timeline
- Published
- Mar 10, 2026
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed