CVE-2021-39206

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.

• CWE-863

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8hThird Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9Third Party Advisory
• https://github.com/pomerium/pomerium/security/advisories/GHSA-cfc2-wjcm-c8fmThird Party Advisory
• https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot Applicable
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8hThird Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9Third Party Advisory
• https://github.com/pomerium/pomerium/security/advisories/GHSA-cfc2-wjcm-c8fmThird Party Advisory
• https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot Applicable

Published

Sep 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39200WordPress is a free and open-source content management syste…5.3
• CVE-2021-39201WordPress is a free and open-source content management syste…5.4
• CVE-2021-39202WordPress is a free and open-source content management syste…5.4
• CVE-2021-39203WordPress is a free and open-source content management syste…6.5
• CVE-2021-39204Pomerium is an open source identity-aware access proxy. Envo…7.5
• CVE-2021-39205Jitsi Meet is an open source video conferencing application.…6.1
• CVE-2021-39207parlai is a framework for training and evaluating AI models …8.8
• CVE-2021-39208SharpCompress is a fully managed C# library to deal with man…4.3
• CVE-2021-39209GLPI is a free Asset and IT management software package. In …8.8
• CVE-2021-3921firefly-iii is vulnerable to Cross-Site Request Forgery (CSR…4.3
• CVE-2021-39210GLPI is a free Asset and IT management software package. In …6.5
• CVE-2021-39211GLPI is a free Asset and IT management software package. Sta…5.3