CVE-2026-73546

Executive Summary

CVE-2026-73546 is a stored cross-site scripting (XSS) vulnerability in the Envoy proxy's /stats?format=html administrative endpoint, affecting all versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The flaw arises because StatsHtmlRender sanitizes statistic values but emits statistic names without HTML encoding, allowing attacker-influenced text to become persistent script when an operator loads the HTML stats page. An operator viewing that page executes attacker-controlled script in the origin of the admin interface, enabling privileged same-origin requests against the Envoy administration API.

Technical Analysis

Envoy is an open-source edge and service proxy widely deployed as a data-plane component in cloud-native service meshes and API gateway architectures. It exposes an administrative interface (commonly bound to a dedicated port) that provides operational endpoints including /stats, /config_dump, /clusters, and /listeners. Among the /stats output formats is an HTML rendering mode selected via the format=html query parameter, served by the StatsHtmlRender component.

The core defect is an output-encoding asymmetry. StatsHtmlRender applies sanitization to statistic values, but writes statistic names into the generated HTML document without HTML encoding. This creates a persistence path: certain data-plane components can fold externally supplied input into the names of dynamic statistics, which are then cached as part of the statistics tree.

The NVD description identifies grpc_stats with the stats_for_all_methods option enabled as a concrete example of such a component. With that option enabled, gRPC method paths — which include path segments that may be attacker-controlled — can be incorporated into cached dynamic statistic names. Because those names are rendered verbatim (unescaped) in the HTML output, any HTML or script metacharacters present in the attacker-influenced segment survive into the served page.

The attack therefore requires two enabling conditions, both explicitly named as the vulnerability's scope boundary:

1. The admin interface must be browser-accessible. An operator (or any user with network reachability to the admin listener) must load /stats?format=html in a browser.
2. An enabled component must persist attacker-influenced text in statistic names. The documented example is grpc_stats with stats_for_all_methods enabled, where dynamic per-method statistics incorporate request-supplied path segments.

This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting), specifically the stored variant. The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N reflects network attackability, high attack complexity (dependent on specific configuration and operator action), no required privileges, no user-interaction precondition in the scoring sense, with high confidentiality and integrity impact and no availability impact.

No public proof-of-concept, exploit code, or Nuclei template is known at this time. No CISA KEV entry exists. The vulnerability is treated here as UNPATCHED by tracked sources (patch confidence 0/4) despite the upstream fix versions being named in the CNA description, meaning no tracked vendor advisory artifact was harvested.

Exploitation Scenarios

Step 1 — Reconnaissance and target identification. An attacker identifies internet- or network-reachable Envoy administrative listeners. The admin interface exposes characteristic endpoints such as /stats, /config_dump, and /clusters; the /stats?format=html path is the specific delivery vector for this flaw. Shodan-style discovery of admin interfaces (for example, via http.title:"Envoy Admin" or the default administrative port) establishes candidate targets. Because the attack chain requires a browser-viewing operator, the practical objective is a target whose trust boundary places privileged human users behind the same admin origin.

Step 2 — Triggering the vulnerability class (stored XSS via unescaped statistic name). The attacker sends traffic through the data plane that causes an enabled component — the description names grpc_stats with stats_for_all_methods enabled — to fold an attacker-controlled path segment into a cached dynamic statistic name. The injected segment carries HTML/script metacharacters. Because StatsHtmlRender fails to HTML-encode statistic names, the malicious content is stored in the statistics tree and later emitted raw into the HTML output.

Step 3 — Payload delivery and execution (vulnerability-class level). When an operator loads /stats?format=html, the injected name is rendered as part of the page. The browser parses the injected content as markup/script, and the script runs in the origin of the administrative interface. No further interaction beyond the operator's page load is required for execution.

Step 4 — Post-exploitation impact. Script executing with the admin origin can issue privileged same-origin requests against the Envoy administration API. This is the critical escalation path: the admin interface provides operational control surfaces (config dumps, cluster state, listener information). Successful same-origin requests can read sensitive configuration and operational data and, in the worst case, induce administrative state changes by abusing the interface's trusted same-origin context. This maps to the CVSS high confidentiality and integrity subscores with no availability impact.

No public PoC or exploit code is available; the chain above is derived strictly from the vulnerability class and the components named in the NVD description. Specific payload strings, statistic-name templates, or request syntax are not provided in the available data and are intentionally not fabricated here.

Impact Assessment

The vulnerability requires specific preconditions — a browser-accessible admin interface and an enabled component that persists attacker-influenced text into statistic names — which raises attack complexity and caps exploitation probability. However, when those conditions hold, impact is high: the attacker gains arbitrary script execution in a highly privileged origin. The CVSS subscores reflect this:

• Confidentiality: High (C:H). Admin-origin script can read administrative data available to the operator's session.
• Integrity: High (I:H). Same-origin requests can influence administrative state via the trusted origin.
• Availability: None (A:N). No direct availability loss is scored.

Affected systems. Any Envoy deployment running versions below 1.36.10, 1.37.6, 1.38.4, or 1.39.1 that (a) exposes the administrative /stats endpoint to a browser context and (b) enables a component such as grpc_stats with stats_for_all_methods. Because Envoy is a foundational data-plane proxy in service mesh and API gateway topologies, a compromised admin interface can extend reach into every service the proxy fronts.

Blast radius. Scoped in practice to environments that meet both enabling conditions. In hardened environments where the admin interface is loopback-bound or otherwise non-browser-accessible, exposure is minimal. In misconfigured or broadly exposed deployments, blast radius is high due to the trust and control the admin origin carries over the data plane.

Detection Guidance

Detection strategy rests on two signals: (1) anomalous requests to the /stats admin endpoint with format=html, and (2) attack-marker content — script or HTML metacharacters — appearing in gRPC method path segments that feed dynamic statistic names.

Sigma Rule

title: Potential Envoy Admin Stats HTML XSS via gRPC Path
id: 9b3f1c2e-7354-4a9b-8f6e-1d0c2b7a5e01
status: experimental
description: Detects access to the Envoy /stats endpoint rendered as HTML, the delivery vector for CVE-2026-73546.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73546
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.79
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'format=html'
  selection_path:
    cs-uri-stem|endswith:
      - '/stats'
  condition: selection_path and selection_uri
falsepositives:
  - Legitimate operator use of the HTML stats view.
level: medium

YARA Rule

rule CVE_2026_73546_Envoy_StatsHtml_XSS
{
    meta:
        description = "Detects script/HTML metacharacters embedded in statistic names surfaced to Envoy HTML stats output"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73546"
        date = "2026-01-01"
        severity = "high"
    strings:
        $grpc = "grpc_stats" ascii
        $html = "format=html" ascii
        $script_open = "<script" nocase ascii
        $script_close = "</script>" nocase ascii
        $onerror = "onerror=" nocase ascii
        $svg = "<svg" nocase ascii
    condition:
        $html or ($grpc and any of ($script_open, $script_close, $onerror, $svg))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73546 Envoy Admin Stats HTML Access"; flow:to_server,established; http.uri; content:"/stats"; http.uri; content:"format=html"; reference:cve,2026-73546; classtype:attempted-recon; sid:2026735460; rev:1;)

alert http any any -> any any (msg:"CVE-2026-73546 Envoy gRPC Path Script Injection Attempt"; flow:to_server,established; http.uri; content:"<script"; nocase; http.uri; pcre:"/<script|onerror=|javascript:/i"; reference:cve,2026-73546; classtype:web-application-attack; sid:2026735461; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [ network where http.request.method == "GET" and url.path : "/stats" and url.query : "format=html" ]
  [ network where http.request.method : ("GET","POST") and url.path : "*/*" and url.query : "*<*" ]

Splunk SPL Query

index=proxy OR index=envoy
| eval uri = coalesce(uri, url, cs_uri)
| where (match(uri, "/stats") AND match(uri, "format=html"))
   OR (match(uri, "<script") OR match(uri, "onerror=") OR match(uri, "javascript:"))
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by uri
| sort - count

Wazuh OSSEC Rule

<group name="envoy,cve-2026-73546,">
  <rule id="202735460" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">/stats</field>
    <field name="url">format=html</field>
    <description>CVE-2026-73546: Access to Envoy HTML stats endpoint (potential stored XSS delivery).</description>
  </rule>
  <rule id="202735461" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.onerror=|&lt;script|javascript:</field>
    <description>CVE-2026-73546: Script metacharacters in request URI (possible statistic-name injection).</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory artifact or patch source was harvested. No official workaround was provided in the data. Until an authoritative advisory is confirmed, the following defensive measures apply.

1) Immediate mitigations.

• Restrict network access to the Envoy administrative interface. Bind the admin listener to loopback or an isolated management network, and place it behind strict firewall/ACL controls so that no operator browses it from an untrusted or shared context.
• Do not browse /stats?format=html from a browser session that also carries access to the admin API; treat the admin interface as a privileged management plane.
• If HTML stats rendering is not operationally required, avoid the format=html view and prefer non-HTML formats.
• Where feasible, disable the enabling condition: review use of grpc_stats with stats_for_all_methods and turn it off unless required by monitoring needs.

2) Patch / upgrade steps.

• Per the CNA description, upgrade to Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 (or later) as the fixed releases. These versions correct the missing HTML encoding of statistic names in StatsHtmlRender.
• Track the official Envoy security advisory channel to confirm the fix and obtain the canonical release reference, as this report's patch confidence is currently 0/4 with no advisory harvested.

3) Long-term hardening.

• Apply output encoding consistently across all rendering paths, and treat any externally influenced statistic name as untrusted input.
• Segment management-plane traffic from data-plane traffic; require strong authentication and authorization for admin endpoints and never expose them publicly.
• Monitor for script/HTML metacharacters arriving via request paths that feed dynamic statistic names, using the detection rules above.
• Maintain an inventory of Envoy versions and enabling options to rapidly assess exposure when the fix is confirmed.

References

• NVD — CVE-2026-73546: https://nvd.nist.gov/vuln/detail/CVE-2026-73546
• MITRE CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html
• Envoy Project security advisories and release notes (confirm advisory for 1.36.10, 1.37.6, 1.38.4, 1.39.1): https://github.com/envoyproxy/envoy/security/advisories
• Envoy documentation — statistics and administration interface reference: https://www.envoyproxy.io/docs/envoy/latest/operations/admin
• CISA Known Exploited Vulnerabilities catalog (verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-73546 at this time; no CISA KEV entry, public PoC, or Nuclei template was identified.