Is CVE-2026-26308 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26308 being exploited in the wild.

How severe is CVE-2026-26308?

High severity, with a CVSS score of 7.5, published 10 March 2026.

Which products and versions are affected?

Envoy Proxy Envoy = 1.37.0, >= 1.36.0, = 1.35.0, <= 1.35.8, <= 1.34.12; github.com/envoyproxy/envoy (Go) SEMVER:introduced=1.37.0,fixed=1.37.1.

Is there a fix for CVE-2026-26308?

Yes. github.com/envoyproxy/envoy (Go): upgrade to 1.37.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26308 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-26308?

Check whether you run Envoy Proxy Envoy or github.com/envoyproxy/envoy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26308: Envoy RBAC header validation bypass via multi-value concatenation

Q: Is there a fix for CVE-2026-26308?

Yes. github.com/envoyproxy/envoy (Go): upgrade to 1.37.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-26308 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-26308?

Check whether you run Envoy Proxy Envoy or github.com/envoyproxy/envoy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26308 · Severity: high · CVSS 7.5 · Published 2026-03-10

Envoy, a high-performance network proxy used to manage traffic between services, contains a flaw in how it handles security rules based on web request headers. An attacker can bypass access controls by sending duplicate headers, which tricks the system into ignoring restricted values. This could allow unauthorized access to sensitive internal resources or administrative interfaces that were intended to be protected.

Technologies: Envoy Proxy Envoy, github.com/envoyproxy/envoy (Go). Vendors: Envoy Proxy, Go.

Quick answers

Is CVE-2026-26308 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26308 being exploited in the wild.
How severe is CVE-2026-26308?: High severity, with a CVSS score of 7.5, published 10 March 2026.
Which products and versions are affected?: Envoy Proxy Envoy = 1.37.0, >= 1.36.0, <= 1.36.4, >= 1.35.0, <= 1.35.8, <= 1.34.12; github.com/envoyproxy/envoy (Go) SEMVER:introduced=1.37.0,fixed=1.37.1.
Is there a fix for CVE-2026-26308?: Yes. github.com/envoyproxy/envoy (Go): upgrade to 1.37.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26308 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-26308?: Check whether you run Envoy Proxy Envoy or github.com/envoyproxy/envoy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/envoyproxy/envoy (Go): upgrade to 1.37.1 or later
```
go get github.com/envoyproxy/envoy@v1.37.1
```

Technical details

The Envoy RBAC (Role-Based Access Control) filter incorrectly processes HTTP headers when multiple instances of the same header name are present. Instead of validating each value individually, the filter uses the 'getAllOfHeaderAsString()' function to concatenate them into a single comma-separated string. If a 'Deny' rule is configured with an 'Exact Match' strategy (e.g., blocking 'internal: true'), an attacker can send two 'internal: true' headers. Envoy concatenates these into 'true,true', which fails the exact match for 'true', thereby bypassing the security policy. Patches are available in versions 1.37.1, 1.36.5, 1.35.9, and 1.34.13.

Affected products

Envoy Proxy Envoy = 1.37.0, >= 1.36.0, <= 1.36.4, >= 1.35.0, <= 1.35.8, <= 1.34.12

Identifiers

CVE-2026-26308
GHSA-ghc4-35x6-crw5

Timeline

2026-03-10: disclosed
2026-03-10: advisory
2026-03-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.