Executive brief
Envoy is a cloud networking proxy that exposes an HTML-based admin interface for viewing traffic statistics. The /stats?format=html endpoint fails to sanitize statistic names, allowing attackers to inject malicious JavaScript that executes in an administrator's browser. An attacker with access to inject statistics (through enabled data-plane components) can execute arbitrary actions with the admin interface's privileges, such as modifying proxy configuration or accessing sensitive metrics.
Technical details
The StatsHtmlRender class in Envoy's admin endpoint sanitizes statistic values but emits statistic names without HTML encoding. Components such as grpc_stats with stats_for_all_methods enabled can persist attacker-controlled path segments into cached dynamic statistic names. When an operator views the /stats?format=html page, the unsanitized name is rendered as HTML, allowing script injection. The vulnerability requires the admin interface to be browser-accessible and an enabled component to persist attacker-influenced text in statistic names.
Affected products
- Envoy Project Envoy before 1.36.10, 1.37.x before 1.37.6, 1.38.x before 1.38.4, 1.39.x before 1.39.1
Timeline
- 2026-09-21: disclosed: CVE-2026-73546 published