A vulnerability in the Envoy proxy HTTP Role-Based Access Control (RBAC) component allows unauthenticated remote attackers to bypass security policies, potentially leading to unauthorized access to sensitive internal services.

This is an improper input validation flaw (CWE-20) where the proxy evaluates safe_regex values using UTF-8 semantics while simultaneously accepting opaque header bytes. An unauthenticated attacker can craft specific header inputs to cause a mismatch in negative RBAC policies, effectively bypassing intended access restrictions.

The exploitation of this vulnerability can result in unauthorized access to restricted backend services that should have been blocked by RBAC policies. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to data confidentiality and network segmentation, as it allows attackers to bypass perimeter security controls and reach protected infrastructure.

Immediate Action: Upgrade to Envoy versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1, as appropriate for your current deployment, to resolve the regex validation error.

Proactive Monitoring: Review Envoy access logs for unusual request patterns involving unexpected characters in headers, particularly if those requests are successfully reaching routes that are typically restricted by RBAC.

Compensating Controls: Ensure that sensitive routes are protected by secondary authentication or authorization layers at the application level while the proxy update is being staged.

Public Exploit Available: Unknown

This vulnerability poses a substantial risk to the integrity of network access controls within cloud-native environments. Organizations utilizing Envoy as an edge or service proxy must prioritize the deployment of the provided security patches to ensure that RBAC policies remain effective and that unauthorized access vectors are closed.