CVE-2026-6994

Executive Summary

CVE-2026-6994 is a high-severity injection vulnerability in the Envoy proxy, affecting versions up to and including 1.33.0. The weakness resides in the params.add function within the header_mutation filter, specifically in the source/extensions/filters/http/header_mutation/header_mutation.cc file. This flaw allows a remote attacker to inject malicious content via query parameters, potentially leading to header manipulation or other injection-based attacks. The vulnerability has a CVSS score of 6.3 (Medium), with a network attack vector and low complexity. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild. A patch is available with the commit hash f8f4f1e02fdc64ecd4acf2d903208dd7285ad3a4.

Supply Chain & Package Security

Envoy is a critical component in many cloud-native environments, often used as a sidecar proxy in service meshes like Istio. This vulnerability could be exploited to manipulate headers, potentially affecting routing, authentication, or other security controls. Organizations using Envoy in their infrastructure should prioritize patching to prevent supply chain attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality Impact (C): None (N)
• Integrity Impact (I): Low (L)
• Availability Impact (A): Low (L)

The threat level is considered medium due to the low complexity and network-based attack vector, but the impact is limited to integrity and availability.

Deep Dive & Mechanics

The vulnerability is located in the header_mutation filter of Envoy, which is responsible for modifying HTTP headers based on configuration. The params.add function is used to add query parameters to the request. Due to insufficient input validation, an attacker can inject arbitrary content into the query parameters, leading to header injection. This can be exploited by crafting a malicious HTTP request with specially crafted query parameters that, when processed by the params.add function, result in unintended header modifications.

The injection occurs because the function does not properly sanitize or escape the input before adding it to the header. This can allow an attacker to inject newline characters or other control characters to manipulate the HTTP response or request headers.

Vulnerable vs. Patched Code

Vulnerable Code (Envoy <= 1.33.0):

// source/extensions/filters/http/header_mutation/header_mutation.cc
void HeaderMutation::params.add(const std::string& key, const std::string& value) {
    // No input validation
    headers.add(key, value);
}

Patched Code (after commit f8f4f1e):

// source/extensions/filters/http/header_mutation/header_mutation.cc
void HeaderMutation::params.add(const std::string& key, const std::string& value) {
    // Input validation to prevent injection
    if (isValidHeaderValue(value)) {
        headers.add(key, value);
    } else {
        // Log or reject the request
        ENVOY_LOG(warn, "Invalid header value detected: {}", value);
    }
}

The patch introduces input validation to ensure that the header value does not contain malicious characters, such as newlines or carriage returns, which could be used for injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Envoy 1.33.0 with the header_mutation filter enabled.
2. Configure a route that uses the filter to add query parameters to headers.
3. Send a crafted HTTP request with malicious query parameters.

Exploitation Steps:

1. Identify an endpoint that uses the header_mutation filter.
2. Craft a request with a query parameter containing injection payloads, e.g., ?param=value%0d%0aInjected-Header: injected.
3. Observe that the injected header is added to the response or request.

Example Exploit (using curl):

curl -v "http://target:8080/path?param=value%0d%0aX-Injected: true"

Blue Team

Detection:

1. Monitor for unusual query parameters containing control characters (e.g., %0d, %0a).
2. Look for unexpected headers in HTTP requests or responses.
3. Use the detection rules provided in the Detection Engineering section.

Mitigation:

1. Apply the patch immediately.
2. Implement input validation for all query parameters.
3. Use Web Application Firewall (WAF) rules to block malicious payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with query parameters containing %0d, %0a, or other control characters.
  • Unexpected headers in HTTP responses, such as X-Injected: true.
• File IOCs:
  • Modified header_mutation.cc file (if patched).
• Log IOCs:
  • Envoy logs containing warnings about invalid header values.

Detection Engineering

YARA Rule

rule CVE_2026_6994_Envoy_Header_Injection {
    meta:
        description = "Detects attempts to exploit CVE-2026-6994 in Envoy header_mutation filter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-6994"
    strings:
        $injection_pattern = /%0[dDaA]|%0[aA]|\\r\\n|\\n/
    condition:
        $injection_pattern
}

Sigma Rule

title: Envoy Header Injection Attempt
id: 8c9a3b2e-1f4d-4a7b-9c6e-5d8f2a1b3c4d
status: experimental
description: Detects HTTP requests with query parameters containing control characters indicative of header injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: envoy
detection:
    selection:
        query_params|contains:
            - '%0d'
            - '%0a'
            - '\\r'
            - '\\n'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in query parameters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-6994 Envoy Header Injection Attempt"; flow:to_server; content:"%0d%0a"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Apply the patch with commit hash f8f4f1e02fdc64ecd4acf2d903208dd7285ad3a4 to the affected Envoy instances.
2. Workaround: If patching is not immediately possible, disable the header_mutation filter or restrict its usage to trusted sources.
3. Long-term: Implement input validation for all query parameters and headers in Envoy configurations.
4. Monitoring: Enable logging for header mutations and monitor for suspicious patterns.
5. Update: Upgrade to Envoy version 1.33.1 or later once available.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 939DF2CCD4BDAE19415846F1] */}