Executive brief
Envoy, a high-performance network proxy used to manage traffic between services, contains a flaw in how it handles security rules based on web request headers. An attacker can bypass access controls by sending duplicate headers, which tricks the system into ignoring restricted values. This could allow unauthorized access to sensitive internal resources or administrative interfaces that were intended to be protected.
Technical details
The Envoy RBAC (Role-Based Access Control) filter incorrectly processes HTTP headers when multiple instances of the same header name are present. Instead of validating each value individually, the filter uses the 'getAllOfHeaderAsString()' function to concatenate them into a single comma-separated string. If a 'Deny' rule is configured with an 'Exact Match' strategy (e.g., blocking 'internal: true'), an attacker can send two 'internal: true' headers. Envoy concatenates these into 'true,true', which fails the exact match for 'true', thereby bypassing the security policy. Patches are available in versions 1.37.1, 1.36.5, 1.35.9, and 1.34.13.
Affected products
- Envoy Proxy Envoy = 1.37.0, >= 1.36.0, <= 1.36.4, >= 1.35.0, <= 1.35.8, <= 1.34.12
Timeline
- 2026-03-10: disclosed
- 2026-03-10: advisory
- 2026-03-10: patched