PT-2026-24377 · Envoy · Envoy

Dor Konis · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-26308

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.37.1 Envoy versions prior to 1.36.5 Envoy versions prior to 1.35.8 Envoy versions prior to 1.34.13

Description Envoy is a high-performance edge/middle/service proxy. The Envoy RBAC (Role-Based Access Control) filter has a logic issue in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, obscuring the malicious value from exact-match mechanisms. The vulnerability affects the validation of headers used in RBAC policies.

Recommendations Update to version 1.37.1. Update to version 1.36.5. Update to version 1.35.8. Update to version 1.34.13. Enable rbac match headers individually.

Exploit

Fix

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

BIT-ENVOY-2026-26308

CVE-2026-26308

GHSA-GHC4-35X6-CRW5

Affected Products

Envoy

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26308.json · Exploit
• https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867 · Patch
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-ghc4-35x6-crw5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26308 · Security Note
• https://osv.dev/vulnerability/GHSA-ghc4-35x6-crw5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26308 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-2026-26308 · Vendor Advisory
• https://github.com/envoyproxy/envoy · Note
• https://twitter.com/VolerionSec/status/2031470363717099981 · Twitter Post
• https://twitter.com/CVEnew/status/2031504151931220436 · Twitter Post
• https://twitter.com/infoflowcloud/status/2031505793481118080 · Twitter Post