CVE-2026-73553

Executive Summary

CVE-2026-73553 is a canonicalization inconsistency in Envoy Proxy's request routing pipeline that allows an unauthenticated downstream client to bypass path-based authorization enforced by the Role-Based Access Control (RBAC) HTTP filter. When the route option ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon path-parameter suffix before path matching, but the RBAC url_path matcher evaluates the raw, unstripped path. This discrepancy permits a request such as /admin;x to evade a DENY rule written against /admin, while the router still forwards the request to the protected /admin backend. Exploitation requires a specific configuration: the route option must be enabled and a path-based RBAC rule protecting a route that matches after suffix stripping. Successful abuse results in unauthorized access to protected backend paths — a confidentiality compromise rated High under CVSS 3.1 (score 7.5, Scope:Changed).

Technical Analysis

The vulnerability class is CWE-436, Interpretation Conflict. Two distinct components of Envoy's HTTP connection manager process the same request path using different canonicalization rules, and the resulting divergence is the exploitable primitive.

The affected components are:

1. The Router filter, which evaluates route matching. When the route configuration option ignore_path_parameters_in_path_matching is enabled, the router strips the semicolon-delimited path-parameter suffix from the request path before evaluating route match predicates. That is, the path segment beginning at the first ; is removed for the purpose of deciding which route applies. Consequently, /admin;x is evaluated for matching as /admin.

2. The RBAC HTTP filter, which evaluates the url_path matcher. Per the NVD description, the RBAC matcher evaluates the raw path — i.e. it does not apply the same semicolon-stripping canonicalization. Therefore a policy containing a DENY rule for /admin does not match the raw string /admin;x.

The security-relevant ordering is that RBAC enforcement and route selection operate on divergent representations of the same request. An attacker submits /admin;x; the RBAC filter compares url_path against /admin, finds no equality, and therefore does not apply the DENY action. The router, applying suffix stripping, matches /admin and selects the backend cluster that serves the protected administrative route. The request reaches a backend path from which the authorization layer intended to exclude the client.

The critical preconditions (verbatim scope boundary from the description) are:

• ignore_path_parameters_in_path_matching is enabled on the relevant route.
• A path-based RBAC rule exists that protects a route matching after suffix stripping.

This is not a memory-safety defect and not a trivial "always exploitable" configuration. It is an enforcement-gap bug rooted in inconsistent path canonicalization between two filters within the same data path. Because the two filters are logically sequential stages of the same request-handling pipeline, an operator reasonably expects the authorization decision to be made on the same canonical path that the router ultimately uses to select the backend. CVE-2026-73553 breaks that invariant.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N reflects: network reachability (AV:N), no privileges required (PR:N), no user interaction (UI:N), and — importantly — a Changed Scope (S:C), because a request authorized against one matching semantics is applied against a backend selected by different matching semantics, escaping the intended security boundary of the enforcement policy. Confidentiality impact is High (C:H), reflecting access to protected content; Integrity impact is Low (I:L); Availability impact is None (A:N). The High Attack Complexity (AC:H) reflects the precondition stack — the route option and a correctly-shaped RBAC rule plus a backend route that matches after stripping must all be present. Note: this is the exact score supplied for this report; it is not overridden.

No public proof-of-concept, Nuclei template, or exploit code was identified at the time of writing. There is no evidence of exploitation in the wild and the CVE is not listed in CISA KEV. The weakness is nonetheless high-value in targeted attack scenarios because it enables direct bypass of an authorization control without authentication.

Exploitation Scenarios

The attack chain below is inferred from the vulnerability class and the scope boundary stated in the NVD description; no public PoC exists. No specific function names, endpoints, or API parameters are asserted beyond those present verbatim in the description (ignore_path_parameters_in_path_matching, url_path, /admin;x, /admin).

1. Reconnaissance / target identification. The adversary identifies an Envoy-deployed edge or service mesh in which an RBAC policy is used for path-based authorization and where the operator has enabled ignore_path_parameters_in_path_matching on relevant routes. Indicators of a candidate target include Envoy admin interface exposure (commonly :9901), mesh/sidecar topologies where RBAC is the primary enforcement control, and administrative paths (e.g. /admin) whose access is governed by RBAC rules. Because the two required preconditions are configuration dependent and not externally advertised, this stage is the principal source of attack complexity (AC:H).

2. Triggering the flaw class. The attacker crafts a request targeting a protected path and appends a semicolon-delimited suffix so that the raw path differs from the canonical path used for routing. The description's concrete example is /admin;x. The exact suffix content is not security relevant per the described mechanism; any suffix that causes the raw url_path value to diverge from the stripped value while routing still resolves to the protected route is sufficient.

3. Payload / execution method at the vulnerability-class level. The attacker issues the crafted request to the Envoy listener handling the affected route. The RBAC filter evaluates url_path against its rules using the raw path and does not match the DENY rule for /admin. The router applies suffix stripping, matches the protected /admin route, and forwards the request to the backend that serves that path. The attacker gains access to the protected route's functionality without satisfying the intended authorization check. No authentication is required (PR:N) and no user interaction is involved (UI:N).

4. Post-exploitation impact. With the path-based authorization control bypassed, the attacker interacts with the protected backend as though authorized, directly affecting confidentiality (C:H) — protected administrative or sensitive content can be read. Integrity exposure is limited (I:L) but present at the vulnerability class level. Because the enforcement boundary is escaped, any downstream control that relies on RBAC path matching as the sole gate for that route is defeated. Scope is Changed (S:C) in the CVSS assessment precisely because the flaw allows a policy meant to govern one representation of the request to be bypassed when the router acts on a different representation. This makes the victim of the exploited weakness not simply the Envoy process but the backend service that trusted the proxy's authorization decision.

Impact Assessment

Envoy is a widely deployed edge and service proxy used in cloud-native architectures, service meshes, and API gateways. The affected system is the Envoy data plane where RBAC path-based authorization is deployed together with the ignore_path_parameters_in_path_matching route option. In such a configuration, path-based RBAC may be the only authentication/authorization gate in front of internal or administrative endpoints; CVE-2026-73553 renders that gate ineffective for the affected routes.

Blast radius is configuration-conditioned rather than universal. Environments that do not enable the route option, or that do not protect routes with a path-based RBAC DENY rule that matches only after suffix stripping, are not exposed to this bypass. Where both conditions hold, however, every fronted route subject to that pattern is potentially reachable by an unauthenticated client with a single crafted request. Multi-tenant and mesh deployments are at elevated risk because a policy failure at one proxy can expose backends that other tenants or services rely upon.

Business impact centers on confidentiality: exposure of protected administrative panels, internal APIs, or sensitive content (C:H). Secondary business risk stems from regulatory exposure where path-based access controls were represented in compliance scope, and from erosion of trust in the proxy as an enforcement point. The changed-scope designation (S:C) further implies that downstream systems' own trust assumptions may be invalidated by the bypass. No availability impact is identified in the CVSS assessment (A:N), and no evidence of active exploitation or public exploit code was identified at report time.

Detection Guidance

Sigma Rule

title: Envoy Path Authorization Bypass via Semicolon Path-Parameter Suffix
id: 3f7b9c2e-1a44-4d0e-9c1b-2026e73553ab
status: experimental
description: Detects HTTP requests containing semicolon-delimited path parameter
  suffixes to paths that also appear as protected routes, indicative of attempts to
  exploit inconsistent path canonicalization between Envoy router and RBAC url_path
  matcher (CVE-2026-73553).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73553
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: envoy
detection:
  selection_semicolon_suffix:
    cs-uri-stem|re: '^/[^;?]+;[^?]*$'
  selection_protected_paths:
    cs-uri-stem|contains:
      - '/admin'
      - '/internal'
      - '/manage'
  condition: selection_semicolon_suffix and selection_protected_paths
falsepositives:
  - Legitimate clients using matrix parameters (RFC 3986 path parameters) on
    non-protected endpoints
  - Application frameworks that intentionally consume path parameters
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-73553
  - cwe.436

YARA Rule

rule CVE_2026_73553_Envoy_Path_Param_Authz_Bypass
{
    meta:
        description = "Detects semicolon-suffixed request paths consistent with Envoy RBAC url_path bypass attempts (CVE-2026-73553)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73553"
        date = "2026-01-01"
        severity = "high"

    strings:
        $method = "GET"
        $method2 = "POST"
        $semi_admin = /\/admin;[A-Za-z0-9._%+-]*/
        $semi_internal = /\/internal;[A-Za-z0-9._%+-]*/
        $semi_manage = /\/manage;[A-Za-z0-9._%+-]*/
        $semi_generic = /\/[A-Za-z0-9._~%+-]+;[A-Za-z0-9._%+-]*\s+HTTP\//
        $useragent = "User-Agent"

    condition:
        any of ($method*) and any of ($semi_admin, $semi_internal, $semi_manage, $semi_generic)
        and not none of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73553 Envoy RBAC path-parameter authorization bypass attempt (semicolon suffix on protected path)"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/\/(admin|internal|manage|api)\x3b[A-Za-z0-9._%+-]*/i"; reference:cve,2026-73553; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73553; classtype:attempted-admin; sid:202673553; rev:1; metadata:affected_product "Envoy Proxy", attack_target Web_Server, deployment Perimeter, confidence Medium, created_at 2026_01_01;) 

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where
      network.application == "http" and
      http.request.method in ("GET", "POST", "PUT", "DELETE") and
      http.request.path regex~ "^/[^;?]+;[^?]*" ]
  [ network where
      network.application == "http" and
      http.response.status_code in (200, 201, 204, 301, 302) and
      http.request.path regex~ "^/(admin|internal|manage|api)[^?]*" ]

Splunk SPL Query

index=web sourcetype=envoy_access
| eval raw_path = coalesce(uri_path, cs_uri_stem, path)
| where match(raw_path, "^\/[^;?]+;[^?]*")
| eval protected_path = if(match(raw_path, "(?i)^\/(admin|internal|manage|api)"), 1, 0)
| where protected_path=1
| stats count min(_time) as first_seen max(_time) as last_seen
        values(raw_path) as sample_paths
        values(src_ip) as source_ips
        values(status) as response_codes
        by dest, src_ip
| where count >= 1
| eval severity = case(count > 50, "HIGH", count > 5, "MEDIUM", true(), "LOW")
| table first_seen last_seen src_ip dest count severity sample_paths response_codes
| sort - count

Wazuh OSSEC Rule

<group name="envoy,web,attack,">
  <rule id="2026735" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">envoy</field>
    <description>CVE-2026-73553: Envoy path-parameter semicolon suffix request on protected path - potential RBAC url_path authorization bypass</description>
    <field name="uri_path">\.+;[^?]+</field>
    <field name="uri_path">^/(admin|internal|manage|api)</field>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73553,</group>
  </rule>

  <rule id="2026736" level="15">
    <if_sid>2026735</if_sid>
    <field name="status">2\d\d</field>
    <description>CVE-2026-73553: Successful response to Envoy path-parameter authorization bypass attempt - likely exploit success</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73553,exploit_success,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Despite the NVD description stating the issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1, no patch evidence was confirmed from any tracked source at the time of writing; treat the environment as unpatched until the vendor release is independently verified and deployed.

1. Immediate mitigations

• Disable the ignore_path_parameters_in_path_matching route option on any route that is also protected by a path-based RBAC rule. This removes the router-side canonicalization step that creates the divergence and restores consistent evaluation between router and RBAC matcher.
• Where the option cannot be disabled, modify RBAC policy shape so that path-based DENY rules cannot be evaded by suffix divergence — for example, enforce authorization through an identity- or header-based principal matcher in addition to path matching, rather than relying on url_path as the sole gate.
• Deploy the provided Suricata signature and Wazuh rules at the network and host edge to detect and alert on semicolon-suffixed requests targeting protected paths while remediation proceeds.
• Restrict or disable external exposure of the Envoy admin interface (commonly port 9901) to reduce reconnaissance surface.

2. Patch / upgrade steps

• Plan an upgrade to the fixed Envoy release line applicable to the deployed branch: 1.36.10, 1.37.6, 1.38.4, or 1.39.1, as stated in the NVD description.
• Because patch verification could not be completed against tracked sources, confirm the exact fix commit and release notes in the upstream Envoy project before and after rollout.
• Validate post-upgrade behavior by replaying the crafted request pattern that previously bypassed the RBAC rule and confirming the DENY action now applies.

3. Long-term hardening

• Standardize request path canonicalization across all filters in the Envoy data path so authorization and routing decisions operate on identical path representations. Treat cross-filter canonicalization consistency as a testable invariant.
• Add automated configuration tests that assert router-to-RBAC path equivalence for every protected route, catching interpretation-conflict regressions before production.
• Follow defense-in-depth for authorization: do not treat a single path-based proxy control as the sole gate for administrative or sensitive backends; enforce authorization at the origin as well.
• Monitor Envoy security advisories and the NVD record for this CVE; reassess in the unlikely event that exploit code or KEV listing emerges.

References

• NVD — CVE-2026-73553: https://nvd.nist.gov/vuln/detail/CVE-2026-73553
• Envoy Project Security Advisories: https://github.com/envoyproxy/envoy/security/advisories
• Envoy Proxy Documentation — RBAC HTTP filter: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/rbac_filter
• Envoy Proxy Documentation — Route configuration (ignore_path_parameters_in_path_matching): https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template was identified for CVE-2026-73553 at report time. No threat actor campaigns or in-the-wild exploitation were identified; CISA KEV status is NO.