CVE-2026-73546

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

• CWE-79

• https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f
• https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8
• https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83
• https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593
• https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
• https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
• https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
• https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73532Fluent Forms Pro 6.2.7 contains an embedded malicious code v…9.8
• CVE-2026-73533Ninja Tables Pro 5.2.11 contains an embedded malicious code …9.8
• CVE-2026-73537Cross-site scripting vulnerability exists in Miraikan Assist…5.1
• CVE-2026-7354Out of bounds read and write in Angle in Google Chrome prior…8.8
• CVE-2026-73541Allocation of Resources Without Limits or Throttling in ZenH…8.2
• CVE-2026-73542Multiple SEIKO EPSON printers and scanners contain revoked r…3.7
• CVE-2026-73547Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-73548Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-73549Envoy is an open source edge and service proxy designed for …5.3
• CVE-2026-7355Use after free in Media in Google Chrome prior to 147.0.7727…8.8
• CVE-2026-73550Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-73551Envoy is an open source edge and service proxy designed for …5.3