CVE-2026-73553 Envoyproxy CVE debrief

Who should care

Defenders responsible for cloud-native applications using Envoy as an edge or service proxy should assess their exposure and prioritize remediation. This includes reviewing Envoy configurations, updating to fixed versions, and applying compensating controls as needed.

Why it matters

CVE-2026-73553 is a high-severity vulnerability in Envoy that allows an unauthenticated client to bypass path-based authorization. Defenders should prioritize upgrading to a fixed version of Envoy or applying compensating controls to mitigate the risk.

• Potential unauthorized access to protected resources via path-based authorization bypass
• Increased risk of lateral movement or privilege escalation in cloud-native environments
• Need for defenders to verify and update path-based RBAC rules to prevent bypass

Technical summary

The vulnerability occurs when ignore_path_parameters_in_path_matching is enabled in Envoy. The router strips semicolon suffixes from paths before matching, but the RBAC url_path matcher evaluates the raw path. This inconsistency allows an unauthenticated client to bypass path-based authorization. Affected product deployments using Envoy as an edge or service proxy should assess their exposure and prioritize remediation. The issue is fixed in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Defenders should review Envoy configurations, update to fixed versions, and apply compensating controls as needed to mitigate the risk of path-based authorization bypass.

Defensive priority

Defenders should prioritize upgrading to a fixed version of Envoy or applying compensating controls to mitigate the risk of path-based authorization bypass.

Recommended defensive actions

• Upgrade to Envoy version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later
• Apply compensating controls, such as additional authentication or access controls, to mitigate the risk of path-based authorization bypass
• Review and update path-based RBAC rules to ensure they are not vulnerable to bypass
• Confirm whether affected Envoy deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The Envoy project's security advisories and release notes offer guidance on mitigation and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.