Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T21:17:09.207Z",
  "pubdate": "2026-09-21T21:17:09.207Z",
  "executiveSummary": "This vulnerability involves an authorization bypass caused by an inconsistency in path normalization between Envoy proxy and downstream servlet-based backends, such as Apache Tomcat.\nThe vulnerability resides in Envoy's path matching logic, specifically when the 'ignore_path_parameters_in_path_matching' configuration is enabled, failing to replicate the per-segment semicolon stripping behavior of certain backends.\nBy manipulating path parameters, a remote unauthenticated attacker can circumvent access control policies implemented at the Envoy layer.\nThe bypass occurs because Envoy fails to correctly interpret the path segments as the backend will, leading to a mismatch where Envoy selects an unprotected fallback route while the backend resolves the request to a protected resource.\nThis impacts all deployments where Envoy serves as an edge proxy for backends that handle semicolon-based matrix parameters per path segment.\nThe risk is critical as it allows for unauthorized access to restricted endpoints, potentially leading to data exfiltration or unauthorized administrative actions, depending on the nature of the target backend resource.",
  "technicalDetails": "The root cause of this vulnerability is a semantic discrepancy between Envoy's path matching engine and the request resolution logic of downstream servlet containers like Apache Tomcat. In standard scenarios, Envoy performs raw request path matching. However, when the 'ignore_path_parameters_in_path_matching' feature is utilized, Envoy truncates the request path at the first semicolon encountered.\nConversely, servlet-based backends are designed to strip semicolon matrix parameters from each individual path segment before attempting resource resolution. This architectural difference creates a blind spot where Envoy and the backend disagree on the structure of the URI.\nAn attacker can exploit this by crafting a request with a path that includes semicolon parameters placed in such a way that Envoy matches it against an unprotected or fallback route, while the backend treats those segments as valid components leading to a protected resource. For example, if a path is structured such that Envoy truncates before a protected segment, but the backend strips the parameter and proceeds to evaluate the actual path, the proxy's security policy will be bypassed because it considers the request to be targeting a different, non-restricted path than the backend ultimately services.\nThe attack flow proceeds as follows: 1) The attacker identifies a protected resource behind the Envoy proxy. 2) The attacker crafts a request using matrix parameters (semicolons) attached to a path segment that would normally trigger an Envoy security policy. 3) Envoy, due to the 'ignore_path_parameters_in_path_matching' configuration, misinterprets or prematurely truncates the path, resulting in the request failing to match the specific security rule intended to protect the resource. 4) The request is forwarded to the backend. 5) The backend processes the path by stripping the semicolon parameters segment-by-segment, effectively normalizing the path back to the intended protected resource, which is then served to the attacker.\nThis issue affects Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Successful exploitation does not require authentication at the Envoy layer, as the bypass occurs during the authorization decision phase. The vulnerability is network-exposed, requiring only connectivity to the Envoy proxy instance."
}