CVE-2026-73552

Executive Summary

CVE-2026-73552 is an input-validation flaw (CWE-20) in Envoy's HTTP RBAC filter affecting all releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The filter accepts RFC-valid opaque header bytes but evaluates safe_regex values using RE2's UTF-8 subject semantics, so a downstream client can preserve a prohibited marker while appending an unrelated obs-text octet, causing RE2::FullMatch to return false. This makes a negative RBAC policy treat the invalid subject as a no-match, while a byte-oriented route matcher still observes the marker — allowing a request to reach a route that policy intended to deny.

Technical Analysis

The vulnerability sits at the intersection of two Envoy subsystems: the HTTP RBAC filter and the route matcher. The core defect is a subject-domain mismatch. Envoy's HTTP RBAC filter accepts header values that are RFC-valid opaque bytes — that is, the full octet range permitted by HTTP header field-value grammar, including obs-text octets. However, when evaluating safe_regex matchers, the RBAC filter hands the raw bytes to RE2 with UTF-8 subject semantics. RE2 interprets the subject as a UTF-8 encoded string rather than as an arbitrary byte sequence.

This creates an exploitable inconsistency. A prohibited marker (the byte sequence an RBAC rule is designed to detect) can be preserved in the header while an unrelated obs-text octet — a byte outside the ASCII range that does not form a valid UTF-8 sequence when combined with surrounding bytes — is appended. When RE2 evaluates the subject under UTF-8 semantics, the invalid encoding causes the match to fail; RE2::FullMatch returns false. Because a negative RBAC policy interprets a non-match as "not prohibited," the request is treated as an ordinary no-match and passes the RBAC check. The safe_regex value never matches, even though the prohibited marker is still present in the raw bytes.

The second half of the flaw is the observation gap. A byte-oriented route matcher — one that inspects raw octets rather than UTF-8-decoded text — can still observe the preserved marker. So the same request is invisible to the RBAC filter's safe_regex evaluation but visible to the route matcher. The attacker's goal is to reach a route that RBAC policy is intended to deny: RBAC fails the request open (for negative policies), and the route matcher then routes it to the protected backend.

The NVD description is explicit about the scope boundary, and this must be preserved precisely:

• Plain positive ALLOW safe_regex values normally fail closed. Only negative RBAC policies (deny-style rules relying on a no-match) are affected.
• Exact, prefix, suffix, and contains matchers are not shown to have this subject-domain failure. The flaw is specific to safe_regex evaluation under UTF-8 subject semantics.

The description does not name specific filter configuration fields, route configuration parameters, header names, or byte sequences. No function names, class names, URL endpoints, API paths, or parameter names beyond RE2::FullMatch and the matcher types named above are available in the supplied intelligence. This report therefore describes the vulnerability class and mechanism rather than inventing implementation specifics.

Attack surface: any Envoy deployment that uses the HTTP RBAC filter with negative policies expressed as safe_regex matchers, and that also uses a byte-oriented route matcher. This is common in cloud-native edge and service-proxy deployments where Envoy fronts downstream services and enforces authorization at the proxy layer. CVSS vector AV:N/AC:L/PR:N/UI:N reflects that exploitation requires no authentication, no privileges, no user interaction, and is reachable over the network; the scope is unchanged (S:U).

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-73552, and the CVE is not listed in CISA KEV. The attack chain below is inferred strictly from the NVD description and vulnerability class; no specific code patterns, header names, or byte sequences are fabricated.

1. Reconnaissance / target identification. The attacker identifies an Envoy-fronted service that enforces authorization via the HTTP RBAC filter with negative policies using safe_regex, and that routes using a byte-oriented route matcher. Fingerprinting Envoy as the edge proxy and identifying RBAC-gated routes is the reconnaissance objective. Because access is unauthenticated (PR:N) and network-reachable (AV:N), the attacker needs no valid credentials.

2. Triggering the flaw class. The attacker crafts an HTTP request whose header value contains a prohibited marker — a byte sequence that an RBAC safe_regex rule is intended to detect — and appends an unrelated obs-text octet (a non-ASCII byte that does not form valid UTF-8 with the surrounding bytes). The header value remains RFC-valid opaque bytes, so it is accepted.

3. Payload / execution method (class level). On evaluation, the RBAC filter passes the header subject to RE2::FullMatch under UTF-8 subject semantics. The invalid UTF-8 sequence causes the full match to return false. Because the RBAC rule is a negative policy, the non-match is treated as "not prohibited," and the request passes the RBAC check. The preserved marker remains in the raw bytes, so the byte-oriented route matcher still observes it and routes the request to the route that policy intended to deny. No code execution, deserialization, or memory-safety primitive is involved; the exploit is purely a semantic mismatch between RBAC evaluation and route matching.

4. Post-exploitation impact. The request reaches a route intended to be denied. Per the CVSS vector, impact is limited to confidentiality (C:H, I:N, A:N), consistent with reaching a protected route/backend and accessing content that RBAC was meant to block. There is no demonstrated integrity or availability impact in the supplied data. A negative ALLOW safe_regex boundary is explicitly not affected — positive ALLOW regexes normally fail closed — so the practical exposure is to deployments relying on deny-style safe_regex rules.

Impact Assessment

The primary impact is unauthorized access to a protected route, expressed in CVSS as high confidentiality impact (C:H) with no integrity or availability impact. The business consequence is authorization bypass at the proxy layer: a request that policy intended to deny is routed to the backend. Blast radius is determined by what the denied route protects — for an Envoy edge proxy, that could be an internal API, a privileged admin surface, or a data-bearing service behind a deny rule.

CVSS subscores:

• AV:N — exploitable over the network; the attacker only needs to reach the Envoy listener.
• AC:L — no special conditions beyond a header value with an obs-text octet; the mechanism is deterministic once the configuration conditions are met.
• PR:N — no authentication or privileges required.
• UI:N — no user interaction; the attacker sends the request directly.
• S:U — impact remains within the same security authority; no scope change is described.
• C:H — the request reaches a route intended to be denied, enabling access to protected content.
• I:N / A:N — no integrity or availability impact is described.

EPSS has not yet been scored by FIRST.org; no EPSS value is fabricated here. The absence of a public PoC and of CISA KEV listing does not reduce the significance of an unauthenticated, network-reachable authorization-bypass primitive in a widely deployed service proxy, but it does mean exploitation is not yet observed in the wild per available data.

Detection Guidance

Detection strategy centers on HTTP header values containing obs-text octets (bytes 0x80–0xFF) on requests to Envoy-fronted services, on RBAC-vs-router decision divergence, and on any logs where an RBAC no-match precedes a route the policy was meant to deny. These are heuristic detections of the vulnerability class; the supplied data does not include specific header names or marker byte sequences.

Sigma Rule

title: Envoy HTTP RBAC safe_regex UTF-8 Subject Bypass Attempt (CVE-2026-73552)
id: 9c1f4b2e-7355-4a10-9f3a-2026cve73552
status: experimental
description: Detects HTTP requests with obs-text (non-ASCII) bytes in header values reaching Envoy-fronted services, consistent with the RBAC safe_regex subject-domain bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73552
author: valtersit.com
logsource:
  category: webserver
  product: envoy
detection:
  selection_method:
    cs-method|in:
      - GET
      - POST
      - HEAD
      - OPTIONS
  selection_obs_text:
    # Match high-bit/obs-text octets in header values or raw request line
    - 'cs-headers|re': '[\x80-\xFF]'
    - 'cs-uri-query|re': '[\x80-\xFF]'
  condition: selection_method and selection_obs_text
falsepositives:
  - Legitimate clients sending non-UTF-8 or extended header encodings
  - Binary-safe APIs and non-text protocols tunneled over HTTP
level: high
tags:
  - attack.t1190
  - cve.2026-73552

YARA Rule

rule CVE_2026_73552_Envoy_RBAC_ObsText_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP request lines containing obs-text octets consistent with Envoy HTTP RBAC safe_regex UTF-8 subject bypass"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73552"
        cve = "CVE-2026-73552"
        date = "2026-01-01"

    strings:
        $method = /(GET|POST|PUT|HEAD|OPTIONS|DELETE|PATCH) /
        // obs-text octets (0x80-0xFF) present in a request header region
        $obstext = /[\x80-\xFF]/
        // CRLF header terminators to scope to header block
        $hdr_end = "\r\n\r\n"

    condition:
        $method at 0 and $obstext in (0..4096) and not $hdr_end in (0..64)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73552 Envoy HTTP RBAC safe_regex UTF-8 subject bypass attempt (obs-text header)"; flow:established,to_server; http.header_names; content:!"|0D 0A|"; pcre:"/[\x80-\xFF]/H"; classtype:attempted-admin; sid:202673552; rev:1; reference:cve,2026-73552; metadata:affected_product Envoy, attack_target Server, deployment Perimeter;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where http.request.method in ("GET","POST","HEAD","OPTIONS")
     and http.request.headers.raw like "*\\x80*" or http.request.headers.raw like "*\\xFF*"]

Splunk SPL Query

index=proxy sourcetype=envoy:access OR sourcetype=envoy
| eval hdr=coalesce(request_headers, headers, "")
| eval has_obstext=if(match(hdr, "[\x80-\xFF]"), 1, 0)
| where has_obstext=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest, uri_path, status
| sort -count

Wazuh OSSEC Rule

<group name="envoy,web,attack,">
  <rule id="2026001" level="10">
    <decoded_as>json</decoded_as>
    <field name="request_headers">[\x80-\xFF]</field>
    <description>CVE-2026-73552: Envoy HTTP RBAC safe_regex subject bypass - obs-text octet in HTTP header</description>
  </rule>
  <rule id="2026002" level="12">
    <if_sid>2026001</if_sid>
    <field name="status">2(00|04|01|03)</field>
    <description>CVE-2026-73552: obs-text header reached a route (possible RBAC bypass successful)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was supplied from any tracked source; the patch source list is empty. However, the NVD description states the issue is fixed in specific upstream versions, so the authoritative remediation is an Envoy upgrade. Until an upgrade is verified in the environment, treat deployments with negative RBAC safe_regex policies as exposed.

1. Immediate mitigations (interim, before upgrade):

   • Replace negative RBAC safe_regex policies with matcher types explicitly not shown to have the subject-domain failure: exact, prefix, suffix, or contains matchers.
   • Where safe_regex must be retained, audit whether the policy is a negative (deny-on-no-match) rule; positive ALLOW safe_regex rules normally fail closed and are not the affected boundary.
   • Enforce byte-level normalization or rejection of obs-text octets (bytes 0x80–0xFF) in HTTP header values at the outer edge (upstream proxy, WAF, or ingress) so invalid-UTF-8 subjects never reach the RBAC filter.
   • Ensure consistency between the RBAC evaluation domain and the route-matcher domain; do not rely on a byte-oriented route matcher to be observed by a UTF-8-semantic RBAC check.

2. Patch / upgrade steps:

   • Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on the tracked release line.
   • Validate that all Envoy instances, sidecars, and ingress data planes in the fleet are on a fixed version — in service-mesh and edge deployments, a single lagging sidecar can preserve exposure.
   • Re-run RBAC policy regression tests against the specific deny routes to confirm the bypass no longer reproduces after upgrade.

3. Long-term hardening:

   • Standardize on matcher types with well-defined byte/character semantics and document which domain (bytes vs. UTF-8) each RBAC and route matcher operates in.
   • Add continuous detection for obs-text octets and RBAC/router decision divergence to CI/CD policy tests.
   • Maintain version tracking and pre-deployment policy validation so future Envoy upgrades and RBAC changes are tested for semantic mismatches before reaching production.

References

• NVD — CVE-2026-73552: https://nvd.nist.gov/vuln/detail/CVE-2026-73552
• Envoy Proxy project (upstream project for the affected releases 1.36.10, 1.37.6, 1.38.4, 1.39.1): https://www.envoyproxy.io/
• CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (score not yet available for this CVE): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are available for CVE-2026-73552 in the supplied intelligence. The CVE is not listed in CISA KEV, no public PoC exists, and no Nuclei template or exploit code has been published.