CVE-2021-29492

Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control, e.g. a block on `/admin`. A backend server could then decode slash sequences and normalize path and provide an attacker access beyond the scope provided for by the access control policy. ### Impact Escalation of Privileges when using RBAC or JWT filters with enforcement based on URL path. Users with back end servers that interpret `%2F` and `/` and `%5C` and `\` interchangeably are impacted. ### Attack Vector URL paths containing escaped slash characters delivered by untrusted client. Patches in versions 1.18.3, 1.17.3, 1.16.4, 1.15.5 contain new path normalization option to decode escaped slash characters. As a workaround, if back end servers treat `%2F` and `/` and `%5C` and `\` interchangeably and a URL path based access control is configured, one may reconfigure the back end server to not treat `%2F` and `/` and `%5C` and `\` interchangeably.

• CWE-22

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-4987-27fx-x6cfMitigation, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-4987-27fx-x6cfMitigation, Third Party Advisory

Published

May 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29486cumulative-distribution-function is an open source npm libra…7.5
• CVE-2021-29487octobercms in a CMS platform based on the Laravel PHP Framew…7.4
• CVE-2021-29488SABnzbd is an open source binary newsreader. A vulnerability…5.3
• CVE-2021-29489Highcharts JS is a JavaScript charting library based on SVG.…5.4
• CVE-2021-29490Jellyfin is a free software media system that provides media…5.8
• CVE-2021-29491Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-29493Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE ex…8.8
• CVE-2021-29495Nim is a statically typed compiled systems programming langu…7.5
• CVE-2021-29499SIF is an open source implementation of the Singularity Cont…7.5
• CVE-2021-29500bubble fireworks is an open source java package relating to …7.5
• CVE-2021-29501Ticketer is a command based ticket system cog (plugin) for t…6.5
• CVE-2021-29502WarnSystem is a cog (plugin) for the Red discord bot. A vuln…6.5