SB2026090352 - Multiple vulnerabilities in Istio
Published: September 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 vulnerabilities.
1) Use of Non-Canonical URL Paths for Authorization Decisions (CVE-ID: CVE-2026-73551)
CWE-ID: CWE-647 - Use of Non-Canonical URL Paths for Authorization Decisions
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass path-based authorization or routing policies.
The vulnerability exists due to use of non-canonical url paths for authorization decisions in URL path normalization and path matching when handling HTTP requests with path segments containing dot or dotdot parameters. A remote attacker can send a specially crafted request to bypass path-based authorization or routing policies.
The issue can also cause path confusion between Envoy and an upstream service.
2) Input validation error (CVE-ID: CVE-2026-73552)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper input validation in the HTTP RBAC safe_regex header matcher when processing RFC-valid obs-text header values containing invalid UTF-8 bytes. A remote attacker can send a specially crafted request header to disclose sensitive information.
Exploitation requires an HTTP RBAC policy that applies safe_regex with negative logic and a protected operation that remains reachable when another consumer still observes the preserved header bytes.
3) Use-after-free (CVE-ID: CVE-2026-73512)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the Envoy QUIC/HTTP/3 datagram handling logic when processing an HTTP/3 Datagram for a stream that has been recreated after an internal redirect or similar stream recreation event. A remote attacker can send a specially crafted HTTP/3 Datagram after stream recreation to cause a denial of service.
Exploitation requires HTTP/3 over QUIC with datagrams enabled, Capsule Protocol in use, and a request flow that triggers stream recreation such as an internal redirect.
4) NULL pointer dereference (CVE-ID: CVE-2026-73547)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to null pointer dereference in the ext_authz filter when processing a path-less CONNECT request after applying query parameter mutations from a successful authorization response. A remote attacker can send a specially crafted path-less CONNECT request to cause a denial of service.
Exploitation requires the ext_authz filter to be enabled, the authorization server to return an OK response containing query parameter mutations, and the deployment to accept path-less CONNECT requests.
5) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-73549)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper check for unusual or exceptional conditions in Utility::copyInternetAddressAndPort() when processing kernel-provided scoped IPv6 destination addresses in ORIGINAL_DST clusters. A remote user can trigger processing of a scoped IPv6 link-local address with a scope ID to cause a denial of service.
This issue is reachable in transparent proxy deployments handling IPv6 link-local traffic, and the crash path requires a real kernel-provided original destination rather than the HTTP header override path.
6) Use-after-free (CVE-ID: CVE-2026-50572)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in RawHttpClientImpl::onSuccess in the ext_authz HTTP client implementation when processing ext_authz HTTP responses. A remote attacker can send a specially crafted response to cause a denial of service.
The issue was observed when Envoy used an HTTP/1.1 service for ext_authz requests.
7) Cross-site scripting (CVE-ID: CVE-2026-73546)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in the administrator\'s browser.
The vulnerability exists due to cross-site scripting in the Envoy admin stats interface (/stats?format=html) when generating HTML output for stat names. A remote attacker can cause attacker-controlled stat names to be recorded and later rendered to execute arbitrary script in the administrator\'s browser.
Exploitation requires a component or filter that records attacker-influenced strings into stat names, and an administrator or automated tool to view the /stats?format=html endpoint in a web browser.
8) NULL pointer dereference (CVE-ID: CVE-2026-48521)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in ProdClusterManagerFactory::allocateConnPool when selecting an HTTP/3 connection pool with a null transport_socket_options pointer. A remote attacker can send routine traffic that reaches a vulnerable cluster configuration to cause a denial of service.
Only deployments using auto_config with HTTP/3 in the protocol set are vulnerable, and the issue is reachable when a LoadBalancerContext returns no upstream transport-socket options, such as in synthetic, mirror, health-check, or async-client side calls.
9) Use-after-free (CVE-ID: CVE-2026-73513)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in common/http/http2 when processing upstream HTTP/2 response trailers without the END_STREAM flag while using oghttp2. A remote attacker can send specially crafted upstream HTTP/2 response headers and trailers to cause a denial of service.
Only the upstream HTTP/2 client path is reachable, and exploitation requires the oghttp2 codec to be enabled.
10) Interpretation Conflict (CVE-ID: CVE-2026-73511)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication or authorization checks.
The vulnerability exists due to interpretation conflict in Envoy path matching when processing request paths containing per-segment path parameters with a backend that strips those parameters per segment. A remote attacker can send a specially crafted request path to bypass authentication or authorization checks.
Exploitation requires a deployment in which Envoy makes path-based security decisions and the backend strips matrix parameters from each path segment.
11) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-73548)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper handling of generic HTTP upgrades in Envoy\'s shared upstream connection pool when processing an HTTP/2 extended CONNECT request for a configured non-WebSocket upgrade type. A remote attacker can send a specially crafted extended CONNECT request containing a self-contained HTTP/1.1 request to disclose sensitive information.
Exploitation requires an HTTP/2 frontend, an HTTP/1.1 keep-alive upstream, and a configured non-WebSocket upgrade_configs entry.
12) Memory leak (CVE-ID: CVE-2026-73550)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in Envoy HTTP/2 header handling when processing HTTP/2 requests containing repeated discarded host headers while :authority is present. A remote attacker can send a specially crafted HTTP/2 request to cause a denial of service.
Exploitation requires the runtime guard for HTTP/2 discarded host header behavior to be enabled and relies on ordinary host headers being discarded before request header byte and count limits are charged.
13) Interpretation Conflict (CVE-ID: CVE-2026-73553)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass path-based authorization controls.
The vulnerability exists due to inconsistent path canonicalization in the envoy router and RBAC url_path matcher when handling requests with path parameters while path-parameter stripping is enabled. A remote attacker can send a specially crafted request path containing a semicolon suffix to bypass path-based authorization controls.
Exploitation requires ignore_path_parameters_in_path_matching to be enabled, a path-based RBAC url_path policy to be configured, and the protected route to match after stripping the path parameter suffix.
14) Cleartext transmission of sensitive information (CVE-ID: N/A)
CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read or modify plaintext traffic.
The vulnerability exists due to improper security behavior in BackendTLSPolicy handling on sidecar proxies when a CA reference cannot be resolved. A remote user can position on the network path to observe or alter traffic to read or modify plaintext traffic.
Gateway proxies are not affected and fail closed. The downgrade is silent, and only ResolvedRefs=False on the policy indicates the condition.
Remediation
Install update from vendor's website.