An unauthenticated authorization bypass vulnerability in Envoy allows attackers to access protected backend routes by exploiting inconsistent path handling.

The vulnerability is an interpretation conflict (CWE-436) occurring when the ignore_path_parameters_in_path_matching option is enabled. The router strips semicolon suffixes before matching, but the RBAC matcher evaluates the raw path, allowing an unauthenticated attacker to bypass access controls on protected endpoints.

Successful exploitation allows unauthorized access to protected backend services, potentially exposing sensitive data or administrative functions. Given the CVSS score of 7.5, this high severity flaw represents a significant risk to cloud native environments where Envoy serves as the primary edge or service proxy.

Immediate Action: Upgrade to versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 immediately to resolve the path canonicalization flaw.

Proactive Monitoring: Review access logs for requests containing path parameters or semicolons directed at sensitive or administrative URI paths.

Compensating Controls: If immediate patching is not feasible, consider disabling the ignore_path_parameters_in_path_matching configuration option or implementing strict path validation at the WAF level.

Public Exploit Available: Unknown

This vulnerability presents a clear risk of unauthorized access to critical services. Administrators should prioritize identifying instances of Envoy where path parameter ignoring is enabled and apply the provided security updates as soon as possible to prevent potential exploitation.