# CVE-2026-26308: envoy — Fixed in 1.37.1 🐹 🐹 Go Not in CISA KEV HIGH severity # CVE-2026-26308 — envoy HIGH [Fix: envoyproxy/envoy@b6ba0b2](https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867) CVE-2026-26308 is a high-severity (CVSS 7.5) CWE-863 vulnerability in github.com/envoyproxy/envoy. A fix is available for github.com/envoyproxy/envoy — see the affected versions and patch details below. Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation Also known asBIT-envoy-2026-26308[GHSA-ghc4-35x6-crw5](/vulnerability/GHSA-ghc4-35x6-crw5) Published Mar 10, 2026 Updated Oct 28, 2026 Affected 4 pkgs Patched 4 / 4 Exploits None indexed Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-26308. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.3%probability of exploitation in next 30 days Lower Risk+0.02% Lower risk than most CVEs26th percentile — riskier than 26% of all scored CVEsHighest risk 0.00%0.28%0.56%0.84%0.0%0.3%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 4 pkgs affected 🐹`github.com/envoyproxy/envoy`🐹`github.com/envoyproxy/envoy`🐹`github.com/envoyproxy/envoy`🐹`github.com/envoyproxy/envoy` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems. ## Description ### 1\. Summary The Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. ### 2\. Attack Scenario Consider an environment where an administrator wants to block external access to internal resources using a specific header flag. #### Configuration The Envoy proxy is configured with a **Deny** rule to reject requests containing the header `internal: true`. - **Rule Type:** Exact Match - **Target:** `internal` header must not equal `true`. #### The Bypass Logic 1. **Standard Request (Blocked):** - **Input:** `internal: true` - **Envoy Processing:** Sees string `"true"`. - **Result:** Match found. **Request Denied.** 2. **Exploit Request (Bypassed):** - **Input:** ``` internal: true internal: true ``` - **Envoy Processing:** Concatenates values into `"true,true"`. - **Matcher Evaluation:** Does `"true,true"` equal `"true"`? **No.** - **Result:** The Deny rule fails to trigger. **Request Allowed.** ### 3\. Implications - **RBAC Bypass:** Remote attackers can bypass configured access controls. - **Unauthorized Access:** Sensitive internal resources or administrative endpoints protected by header-based Deny rules become accessible. - **Risk:** High, particularly for deployments relying on "Exact Match" strategies for security blocking. ### 4\. Reproduction Steps To verify this vulnerability: 1. **Deploy Envoy:** Configure an instance with an RBAC **Deny** rule that performs an **exact match** on a specific header (e.g., `internal: true`). 2. **Baseline Test:** Send a request containing the header `internal: true`. - _Observation:_ Envoy blocks this request (HTTP 403). 3. **Exploit Test:** Send a second request containing the same header twice: ``` GET /restricted-resource HTTP/1.1 Host: example.com internal: true internal: true ``` - _Observation:_ Envoy allows the request, granting access to the resource. ### 6\. Recommendations **Fix Header Validation Logic:** Modify the RBAC filter to validate each header value instance individually. Avoid relying on the concatenated string output of `getAllOfHeaderAsString()` for security-critical matching unless the matcher is explicitly designed to parse comma-separated lists. \*\* Examine the DENY role to use a Regex style fix. **Credit:** Dor Konis ## Affected Packages 4 total 4 fixed Ecosystem Package Vulnerable range Fix 🐹Go `github.com/envoyproxy/envoy` ≥ 1.37.0&&< 1.37.1 1.37.1`go get github.com/envoyproxy/envoy@v1.37.1` 🐹Go `github.com/envoyproxy/envoy` ≥ 1.36.0&&< 1.36.5 1.36.5`go get github.com/envoyproxy/envoy@v1.36.5` 🐹Go `github.com/envoyproxy/envoy` ≥ 1.35.0&&< 1.35.9 1.35.9`go get github.com/envoyproxy/envoy@v1.35.9` 🐹Go `github.com/envoyproxy/envoy` all versions 1.34.13`go get github.com/envoyproxy/envoy@v1.34.13` ## Affected Products 1 product · 4 configurations Application `envoy`envoyproxy ≥ 1.36.0 && < 1.36.5 1 version 1.37.0 ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/envoyproxy/envoy, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update github.com/envoyproxy/envoy to 1.37.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-26308 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Frequently Asked Questions \## 1. Summary The Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. ## 2. Attack Scenario Consider an environment where an administrator wants to block external access to inter O3 Security · Impact-Aware SCA ### Is CVE-2026-26308 in your dependencies? Find it across Go, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)