{"id":"CVE-2026-26308","summary":"Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation","details":"Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically \"Deny\" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.","aliases":["BIT-envoy-2026-26308","GHSA-ghc4-35x6-crw5"],"modified":"2026-08-12T15:32:01.064733Z","published":"2026-03-10T19:01:28.062Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26308.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26308.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-ghc4-35x6-crw5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26308"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"fixed":"7c0fda3dc457de6ee4585e8129e3f5728d65f367"},{"introduced":"84305a6cb64bd55aaf606bdd53de7cd6080427a1"},{"fixed":"9a0cdcadabcb7baa2348afa1178e083f8d0fe2d7"},{"introduced":"63ee0dc79dce88117c6bd2df5a742f8eb67ea980"},{"fixed":"41749943780b54b70b510b1b1a4805ae529e174a"},{"introduced":"6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"},{"fixed":"b6ba0b2294b98484fb0ed8556897d1073cc27867"}],"database_specific":{"cpe":["cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","cpe:2.3:a:envoyproxy:envoy:1.37.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"1.34.13"},{"introduced":"1.35.0"},{"fixed":"1.35.8"},{"introduced":"1.36.0"},{"fixed":"1.36.5"},{"introduced":"1.37.0"},{"last_affected":"1.37.0"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["1.37.0","v1.34.12","v1.36.4","v1.36.3","v1.34.11","v1.35.7","v1.34.10","v1.35.6","v1.36.2","v1.36.1","v1.35.5","v1.34.9","v1.36.0","v1.35.4","v1.34.8","v1.35.3","v1.34.7","v1.35.2","v1.34.6","v1.34.5","v1.35.1","v1.34.4","v1.35.0","v1.34.3","v1.34.2","v1.34.1","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26308.json","vanir_signatures_modified":"2026-08-12T15:32:01Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","target":{"file":"source/common/http/header_utility.h"},"deprecated":false,"digest":{"line_hashes":["307993278646808064273918717381878634534","93966140253654315037002192513861528773","94157562991279752868771655872517105857","266042391640566171413120697661715997046","281928225354114759985217343597918252883","26931787561531805013053852709920780261"],"threshold":0.9},"id":"CVE-2026-26308-15fec99b"},{"deprecated":false,"digest":{"line_hashes":["331784845532747690511365370713018762015","32016695196553354873907498678782425890","238550549931939169309634354367918055721","205459903706198659916698677138889763768","327540819630509000694278953375045971202","121468385808218468450195827435775983915","145684759757382830150162795105163887696","155434208676838736010779821591969519354","167119706264252282889535574080480925109"],"threshold":0.9},"id":"CVE-2026-26308-1d9050e3","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","target":{"file":"source/extensions/filters/common/rbac/matchers.h"}},{"source":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["63350482614684853589080884968993691136","274621385026985150605388013864626608087","30194948638454257386779764387151425144","221187988563176933400201284535489390631"],"threshold":0.9},"id":"CVE-2026-26308-3b8f6488","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["319916229507619455485150288447908852694","7822889389478140330478805139926222365","330804399155879790691254347699106084369"],"threshold":0.9},"id":"CVE-2026-26308-5aee358a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","target":{"file":"test/extensions/filters/common/rbac/matchers_test.cc"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","target":{"file":"test/common/http/header_utility_test.cc"},"deprecated":false,"digest":{"line_hashes":["123681333993630434883126451148456745127","176402239509480841329196599773201997150","326272921497272327569387017379014016221"],"threshold":0.9},"id":"CVE-2026-26308-74677230","signature_type":"Line"},{"digest":{"line_hashes":["113972512269161541748225039007176214253","251781383151711670630223209923564123317","144953606160475839163036141392730252427","244772715440972028247835740794047149917","103709824501716579595453039284462618410","184934869710487780104910894321294393560"],"threshold":0.9},"id":"CVE-2026-26308-82e207b5","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","target":{"file":"test/extensions/filters/http/rbac/rbac_filter_integration_test.cc"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"2636148190921487010531923718541353785","length":141},"id":"CVE-2026-26308-aa6d49e0","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","target":{"function":"HeaderMatcher::matches","file":"source/extensions/filters/common/rbac/matchers.cc"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","target":{"file":"source/extensions/filters/common/rbac/matchers.cc"},"deprecated":false,"digest":{"line_hashes":["339774293788940641181549077199716704174","103547314086159498647374723623263326759","90010073243512176453796892685853014691","268912331777502240978657112028227592712","246714598471284408576981357761520398648","201380783952932465387025946168456931009","177781130313580876890219137174234923767","118937163696031249535077225779442556847","260018622786342720680560213460204060791","66153436295360759956019924662611022470"],"threshold":0.9},"id":"CVE-2026-26308-cd053573","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["290197355003660930592911448274699094308","172895980987054801544210323060019839530","92671839262669939685194527957196284514","105516405803016880189865712323658473841"],"threshold":0.9},"id":"CVE-2026-26308-d26f6557","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","target":{"file":"envoy/http/header_map.h"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N"}]}