CVE-2023-27487

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-path` should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header would then be used for trace logs and grpc logs, as well as used in the URL used for `jwt_authn` checks if the `jwt_authn` filter is used, and any other upstream use of the x-envoy-original-path header. Attackers may forge a trusted `x-envoy-original-path` header. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 have patches for this issue.

• CWE-20

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-5375-pq35-hf2gExploit, Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-5375-pq35-hf2gExploit, Vendor Advisory

Published

Apr 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27481Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2023-27482homeassistant is an open source home automation tool. A remo…10
• CVE-2023-27483crossplane-runtime is a set of go libraries used to build Ku…7.5
• CVE-2023-27484crossplane-runtime is a set of go libraries used to build Ku…4.9
• CVE-2023-27485thmmniii/fbs-core is an open source feedback system for stud…4.3
• CVE-2023-27486xCAT is a toolkit for deployment and administration of compu…8.8
• CVE-2023-27488Envoy is an open source edge and service proxy designed for …9.8
• CVE-2023-27489Kiwi TCMS is an open source test management system for both …5.4
• CVE-2023-2749Download Center fails to properly validate the file path sub…7.5
• CVE-2023-27490NextAuth.js is an open source authentication solution for Ne…8.8
• CVE-2023-27491Envoy is an open source edge and service proxy designed for …9.1
• CVE-2023-27492Envoy is an open source edge and service proxy designed for …6.5