CVE-2026-73546 in Envoy
Summary
by MITRE • 09/21/2026
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/21/2026
Envoy serves as a critical infrastructure component for cloud-native environments, functioning as an edge and service proxy that manages traffic flow between services. The vulnerability identified in versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 resides within the administrative interface's statistics endpoint when accessed with the HTML format parameter. Specifically, the StatsHtmlRender implementation exhibits a partial sanitization flaw where it correctly escapes or sanitizes string statistic values but fails to apply equivalent HTML encoding to statistic names before rendering them in the DOM. This inconsistency creates an opportunity for Cross-Site Scripting attacks if specific conditions are met regarding how statistics are generated and exposed.
The technical root cause involves dynamic statistic name generation within data-plane components, particularly when using grpc_stats with stats_for_all_methods enabled. In this configuration, Envoy can incorporate path segments from incoming gRPC requests directly into the names of dynamically created statistical metrics. Since these path segments originate from client-side HTTP or gRPC traffic, they are effectively attacker-controlled inputs. When an administrator accesses the admin interface to view system health and performance data via a web browser, the unencoded statistic names containing malicious script payloads are rendered as part of the HTML document structure rather than being treated as plain text.
This flaw constitutes a stored Cross-Site Scripting vulnerability, categorized under CWE-79 in industry standards for Improper Neutralization of Input During Web Page Generation. The operational impact is significant because it allows an attacker to execute arbitrary JavaScript within the context of the admin interface's origin. This execution environment grants the malicious script full access to cookies, session tokens, and local storage associated with the Envoy administrative dashboard. Consequently, attackers can perform privileged same-origin requests on behalf of the authenticated administrator, potentially leading to unauthorized configuration changes, data exfiltration from internal services monitored by Envoy, or further lateral movement within the cluster if the admin interface has access to sensitive management APIs.
The scope of this vulnerability is constrained by specific prerequisites that must be satisfied for exploitation to succeed. First, the Envoy administrative interface must be accessible via a standard web browser, which implies it should not be strictly firewalled off from user-facing networks or protected solely by network-level controls without authentication and secure session management. Second, an enabled component such as grpc_stats with stats_for_all_methods must be active in the deployment configuration to ensure that attacker-controlled path segments are persisted into statistic names rather than being discarded or ignored. Without these conditions, the attack vector remains theoretical despite the presence of the code flaw.
Mitigation strategies primarily involve upgrading Envoy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 and later, where this encoding inconsistency has been resolved by ensuring all dynamic content is properly escaped before HTML rendering. In environments where immediate patching is not feasible, operators should restrict access to the admin interface using strict network policies, such as limiting connectivity to trusted management subnets only, thereby preventing remote attackers from reaching the vulnerable endpoint. Additionally, implementing robust authentication and multi-factor authorization for the admin UI can reduce the risk of successful exploitation by ensuring that even if a script is executed, it cannot easily perform privileged actions without valid credentials. Monitoring logs for unusual patterns in gRPC paths may also help detect attempted probing or exploitation activities targeting this specific vector.