7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26308

CVE-2026-26308: Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation

1. Summary

The Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms.

2. Attack Scenario

Consider an environment where an administrator wants to block external access to internal resources using a specific header flag.

Configuration

The Envoy proxy is configured with a Deny rule to reject requests containing the header internal: true.

Rule Type: Exact Match
Target: internal header must not equal true.

The Bypass Logic

Standard Request (Blocked):
- Input: internal: true
- Envoy Processing: Sees string "true".
- Result: Match found. Request Denied.
Exploit Request (Bypassed):
- Input:
```
internal: true
internal: true
```
- Envoy Processing: Concatenates values into "true,true".
- Matcher Evaluation: Does "true,true" equal "true"? No.
- Result: The Deny rule fails to trigger. Request Allowed.

3. Implications

RBAC Bypass: Remote attackers can bypass configured access controls.
Unauthorized Access: Sensitive internal resources or administrative endpoints protected by header-based Deny rules become accessible.
Risk: High, particularly for deployments relying on "Exact Match" strategies for security blocking.

4. Reproduction Steps

To verify this vulnerability:

Deploy Envoy: Configure an instance with an RBAC Deny rule that performs an exact match on a specific header (e.g., internal: true).
Baseline Test: Send a request containing the header internal: true.
- Observation: Envoy blocks this request (HTTP 403).
Exploit Test: Send a second request containing the same header twice:
```
GET /restricted-resource HTTP/1.1
Host: example.com
internal: true
internal: true
```
- Observation: Envoy allows the request, granting access to the resource.

6. Recommendations

Fix Header Validation Logic: Modify the RBAC filter to validate each header value instance individually. Avoid relying on the concatenated string output of getAllOfHeaderAsString() for security-critical matching unless the matcher is explicitly designed to parse comma-separated lists.

** Examine the DENY role to use a Regex style fix.

Credit: Dor Konis

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26308

CVE-2026-26308:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/envoyproxy/envoy	go	= 1.37.0	1.37.1
github.com/envoyproxy/envoy	go	>= 1.36.0, <= 1.36.4	1.36.5
github.com/envoyproxy/envoy	go	>= 1.35.0, <= 1.35.8	1.35.9
github.com/envoyproxy/envoy	go	<= 1.34.12	1.34.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Envoy's RBAC filter's handling of HTTP headers with multiple values. The core issue is that the filter concatenates values from headers with the same name into a single comma-separated string before applying matching rules. This allows an attacker to bypass 'Deny' rules that use an 'exact match' condition.

For instance, if a policy is set to deny requests with the header internal: true, an attacker can send a request containing two instances of that header. The RBAC filter processes this as a single header with the value "true,true". The exact match comparison against "true" fails, thus bypassing the security policy and granting unauthorized access.

The patch rectifies this by introducing a new function, matchesHeadersIndividually, which iterates through each header value and applies the matching logic to them one by one. This ensures that if any of the values match the deny rule, the request is correctly blocked. The new, secure behavior is controlled by the runtime flag envoy.reloadable_features.rbac_match_headers_individually.

The function HeaderMatcher::matches is the primary vulnerable function as it orchestrates this flawed matching process. The helper function HeaderDataImpl::matchesHeaders is also directly involved by providing the concatenated header string that enables the bypass.

Vulnerable functions

HeaderMatcher::matches

source/extensions/filters/common/rbac/matchers.cc

This function is the entry point for RBAC header matching. Before the patch, it unconditionally called `header_->matchesHeaders(headers)`, which uses a concatenated string of all header values. This allowed an attacker to bypass an exact match 'Deny' rule by sending a duplicate header (e.g., 'internal: true', 'internal: true'), which would be concatenated to 'true,true' and not match the deny rule for 'true'. The patch introduces a conditional call to the new, secure `matchesHeadersIndividually` function.

HeaderDataImpl::matchesHeaders

source/common/http/header_utility.h

This function is responsible for retrieving header values for matching. The vulnerable behavior stems from this function providing a single, comma-separated string for multi-value headers to the caller. This concatenated string is then used for security-sensitive exact-match comparisons, leading to the bypass. The introduction of `matchesHeadersIndividually` in the patch highlights the flaw in the original approach.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-26308: Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation

1. Summary

2. Attack Scenario

Configuration

The Bypass Logic

3. Implications

4. Reproduction Steps

6. Recommendations

CVE-2026-26308:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2026-26308: Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation

1. Summary

2. Attack Scenario

Configuration

The Bypass Logic

3. Implications

4. Reproduction Steps

6. Recommendations

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

7.5

7.5

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI