en
Envoy Proxy is an open-source project that provides a high-performance Layer 7 edge, middle, and service proxy for cloud-native applications. It supports traffic routing, service-to-service communication, observability, policy enforcement, and extensibility, and is commonly deployed as an edge proxy, sidecar, or gateway in distributed systems.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/22/2026, envoyproxy recorded 20 security vulnerabilities in the last 90 days across 2 products, including 10 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, envoy had the most security vulnerabilities in the envoyproxy ecosystem, with 13 vulnerabilities—approximately 65% of the provider's total vulnerabilities during this period.
CVE-2026-73511Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)CVE-2026-73553Envoy: RBAC Authorization Bypass via Path ParametersCVE-2026-73551Envoy: Path normalization does not handle dot and dotdot segments with parametersCVE-2026-73546Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)CVE-2026-73512Envoy: use-after-free in QUIC on internal redirects136 Results | Page 1 of 14
| SeverityHigh |
| SeverityMedium |
| SeverityHigh |
| SeverityHigh |
| SeverityHigh |
| SeverityHigh |
| SeverityMedium |
| SeverityMedium |
| SeverityHigh |