PT-2026-24377 · Envoy · Envoy

Dor Konis · Publicado 2026-03-10 · Atualizado 2026-03-12 · CVE-2026-26308

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.37.1 Envoy versions prior to 1.36.5 Envoy versions prior to 1.35.8 Envoy versions prior to 1.34.13

Description Envoy is a high-performance edge/middle/service proxy. The Envoy RBAC (Role-Based Access Control) filter has a logic issue in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, obscuring the malicious value from exact-match mechanisms. The vulnerability affects the validation of headers used in RBAC policies.

Recommendations Update to version 1.37.1. Update to version 1.36.5. Update to version 1.35.8. Update to version 1.34.13. Enable rbac match headers individually.

Exploit

Correção

Incorrect Authorization

RCE

Enumeração de Fraquezas

CWE-863

CWE-20

Identificadores relacionados

BIT-ENVOY-2026-26308

CVE-2026-26308

GHSA-GHC4-35X6-CRW5

Produtos afetados

Envoy

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26308.json · Exploit
• https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867 · Correção
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-ghc4-35x6-crw5 · Aviso do Fabricante
• https://github.com/envoyproxy/envoy · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-26308 · Nota de Segurança
• https://twitter.com/VolerionSec/status/2031470363717099981 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2031504151931220436 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-ghc4-35x6-crw5 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-26308 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2031505793481118080 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-envoy-2026-26308 · Aviso do Fabricante