CVE-2026-73552 Envoyproxy CVE debrief

Who should care

Defenders managing Envoy deployments, especially those using versions prior to 1.36.10, 1.37.6, 1.38.4, or 1.39.1, should assess their exposure and prioritize remediation due to the high severity of this vulnerability.

Why it matters

CVE-2026-73552 is a high-severity vulnerability in Envoy that allows a downstream client to bypass intended RBAC policies. Defenders managing Envoy deployments should assess their exposure and prioritize remediation due to the potential for unauthorized access and the need for verification of Envoy version and patch application.

• Potential bypass of intended RBAC policies
• Increased risk of unauthorized access to protected resources
• Need for verification of Envoy version and patch application
• Potential for increased monitoring and logging to detect exploitation attempts

Technical summary

The vulnerability in Envoy's HTTP RBAC allows a downstream client to preserve a prohibited marker and add an unrelated obs-text octet, causing RE2::FullMatch to return false and a negative RBAC policy to treat the invalid subject as an ordinary no-match. This issue is fixed in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The vulnerability has a high CVSS score of 7.5 and is considered a critical concern for defenders managing Envoy deployments. The issue requires verification of Envoy version and patch application, as well as review and update of RBAC configurations to ensure proper enforcement.

Defensive priority

Defenders should prioritize assessment and remediation of this vulnerability, especially those managing Envoy deployments. The vulnerability's high CVSS score of 7.5 and potential for bypassing security controls make it a critical concern.

Recommended defensive actions

• Assess Envoy deployments for exposure, especially those using versions prior to 1.36.10, 1.37.6, 1.38.4, or 1.39.1
• Verify and apply patches to affected Envoy versions
• Review and update RBAC configurations to ensure proper enforcement
• Monitor Envoy logs for potential exploitation attempts
• Perform vulnerability scanning to identify exposed assets
• Implement additional monitoring and logging to detect exploitation attempts
• Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score, affected versions, and fixed versions. However, the corpus does not provide explicit information on exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.