CVE-2026-26308
- Source
- https://cve.org/CVERecord?id=CVE-2026-26308
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26308.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-26308
- Aliases
- Published
- 2026-03-10T19:01:28.062Z
- Modified
- 2026-07-16T00:03:45.019791Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
- Summary
- Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation
- Details
-
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
- Database specific
{ "cwe_ids": [ "CWE-863" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26308.json" }- References
Affected packages
Git / github.com/envoyproxy/envoy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/envoyproxy/envoy
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
{ "cpe": [ "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "cpe:2.3:a:envoyproxy:envoy:1.37.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "1.34.13" }, { "introduced": "1.35.0" }, { "fixed": "1.35.8" }, { "introduced": "1.36.0" }, { "fixed": "1.36.5" }, { "introduced": "1.37.0" }, { "last_affected": "1.37.0" } ], "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ] }
Affected versions
1.*
1.37.0
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.34.1
v1.34.10
v1.34.11
v1.34.12
v1.34.2
v1.34.3
v1.34.4
v1.34.5
v1.34.6
v1.34.7
v1.34.8
v1.34.9
v1.35.0
v1.35.1
v1.35.2
v1.35.3
v1.35.4
v1.35.5
v1.35.6
v1.35.7
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
Database specific
vanir_signatures_modified
"2026-07-16T00:03:45Z"
vanir_signatures
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"307993278646808064273918717381878634534",
"93966140253654315037002192513861528773",
"94157562991279752868771655872517105857",
"266042391640566171413120697661715997046",
"281928225354114759985217343597918252883",
"26931787561531805013053852709920780261"
]
},
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867",
"id": "CVE-2026-26308-15fec99b",
"target": {
"file": "source/common/http/header_utility.h"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"331784845532747690511365370713018762015",
"32016695196553354873907498678782425890",
"238550549931939169309634354367918055721",
"205459903706198659916698677138889763768",
"327540819630509000694278953375045971202",
"121468385808218468450195827435775983915",
"145684759757382830150162795105163887696",
"155434208676838736010779821591969519354",
"167119706264252282889535574080480925109"
]
},
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867",
"id": "CVE-2026-26308-1d9050e3",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.h"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"63350482614684853589080884968993691136",
"274621385026985150605388013864626608087",
"30194948638454257386779764387151425144",
"221187988563176933400201284535489390631"
]
},
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867",
"id": "CVE-2026-26308-3b8f6488",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"319916229507619455485150288447908852694",
"7822889389478140330478805139926222365",
"330804399155879790691254347699106084369"
]
},
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867",
"id": "CVE-2026-26308-5aee358a",
"target": {
"file": "test/extensions/filters/common/rbac/matchers_test.cc"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"123681333993630434883126451148456745127",
"176402239509480841329196599773201997150",
"326272921497272327569387017379014016221"
]
},
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867",
"id": "CVE-2026-26308-74677230",
"target": {
"file": "test/common/http/header_utility_test.cc"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"113972512269161541748225039007176214253",
"251781383151711670630223209923564123317",
"144953606160475839163036141392730252427",
"244772715440972028247835740794047149917",
"103709824501716579595453039284462618410",
"184934869710487780104910894321294393560"
]
},
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867",
"id": "CVE-2026-26308-82e207b5",
"target": {
"file": "test/extensions/filters/http/rbac/rbac_filter_integration_test.cc"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 141.0,
"function_hash": "2636148190921487010531923718541353785"
},
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867",
"id": "CVE-2026-26308-aa6d49e0",
"target": {
"function": "HeaderMatcher::matches",
"file": "source/extensions/filters/common/rbac/matchers.cc"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"339774293788940641181549077199716704174",
"103547314086159498647374723623263326759",
"90010073243512176453796892685853014691",
"268912331777502240978657112028227592712",
"246714598471284408576981357761520398648",
"201380783952932465387025946168456931009",
"177781130313580876890219137174234923767",
"118937163696031249535077225779442556847",
"260018622786342720680560213460204060791",
"66153436295360759956019924662611022470"
]
},
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867",
"id": "CVE-2026-26308-cd053573",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"290197355003660930592911448274699094308",
"172895980987054801544210323060019839530",
"92671839262669939685194527957196284514",
"105516405803016880189865712323658473841"
]
},
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867",
"id": "CVE-2026-26308-d26f6557",
"target": {
"file": "envoy/http/header_map.h"
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26308.json"