Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-21T20:17:28.040Z",
  "pubdate": "2026-09-21T20:17:28.040Z",
  "executiveSummary": "Envoy is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability within its /stats?format=html admin interface. The flaw originates from the improper handling of dynamic statistic names, which are rendered without adequate HTML entity encoding.\nA remote attacker can leverage data-plane components, such as grpc_stats with stats_for_all_methods enabled, to inject arbitrary content into statistic names via attacker-controlled path segments. When an administrator accesses the /stats page, the malicious payload is executed within the browser's context under the origin of the Envoy admin interface.\nThis vulnerability allows an attacker to execute unauthorized scripts, potentially enabling the issuance of privileged same-origin requests or the exfiltration of sensitive administrative data. The exploitation requires the admin interface to be accessible to a browser and the presence of a component that persists attacker-influenced text in statistic names.\nThe vulnerability affects Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Remediation requires updating to the patched versions.",
  "technicalDetails": "The vulnerability resides in the StatsHtmlRender function responsible for processing and displaying metrics on the Envoy /stats?format=html admin endpoint. While StatsHtmlRender performs sanitization on the values of statistics, it fails to sanitize or HTML-encode the statistic names themselves before emitting them to the HTTP response.\nThe attack vector involves the manipulation of statistic names, which can be influenced by external input when certain data-plane configurations are active. Specifically, when the grpc_stats component is configured with stats_for_all_methods enabled, Envoy dynamically generates statistic names that include components of the request path. If an attacker crafts a request containing malicious strings within the path, these segments are incorporated into the internal statistic naming structure.\nBecause these statistics are cached and persisted within the Envoy process, they become a permanent part of the internal metrics registry. When an operator views the /stats endpoint using a web browser, the StatsHtmlRender logic iterates through the stored metrics and reflects these unsanitized, attacker-influenced strings directly into the generated HTML DOM. This lack of output encoding leads to the execution of arbitrary JavaScript.\nThe exploitation flow is as follows: 1) The attacker sends a request to the Envoy proxy with a specifically crafted, malicious path segment. 2) The grpc_stats component, configured to track all methods, consumes this path segment and creates a new, cached statistic name containing the attacker's payload. 3) The malicious string remains in the Envoy statistics memory. 4) An administrative user visits the /stats?format=html URL. 5) The admin interface renders the HTML, triggering the execution of the attacker's script in the user's browser session. 6) The script executes with the same-origin privileges of the Envoy admin interface, allowing it to perform unauthorized administrative actions or interact with sensitive endpoints.\nThe scope of this vulnerability is limited by the requirement for a browser to access the admin interface and the enabling of a component that persists user-influenced text in statistics. No direct authentication bypass is required to reach the /stats endpoint if it is exposed; however, the impact is magnified because the script executes within the context of the administrative user, potentially leading to a full compromise of the proxy management interface."
}