CVE-2026-73553High· 7.5▾ MidnightPoC availableEnvoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix befo…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Exploit / PoC code exists
Last analysed / modified upstream
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
envoy < 1.36.10envoy >= 1.37.0, < 1.37.6envoy >= 1.38.0, < 1.38.4envoy >= 1.39.0, < 1.39.1Upgrade past the affected range:
envoy 1.39.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73511Medium· 5.3Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73546High· 7.4Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73512High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73548High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73513High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-48521Medium· 5.9Envoy is an open source edge and service proxy designed for cloud-native applications