CVE-2025-46821 Envoy vulnerable to bypass of RBAC uri_template permission

What is CVE-2025-46821?

CVE-2025-46821 is a medium-severity vulnerability in Envoyproxy Envoy, published on 7 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the `*` character from a set of valid characters in the URI path. As a result URI path containing the `*` character will not match a URI template expressions. This can result in bypass of RBAC rules when configured using the `uri_template` permissions. This vulnerability is fixed in Envoy versions v1.34.1, v1.33.3, v1.32.6, v1.31.8. As a workaround, configure additional RBAC permissions using `url_path` with `safe_regex` expression.

Weakness: CWE-186

Which versions are affected by CVE-2025-46821?

1 open source package ship an affected version, including envoy. It affects 1 product.

Products include Envoyproxy Envoy.

How do I fix CVE-2025-46821?

Upgrade envoy to a fixed version for your release line: 1.31.8, 1.32.6, 1.33.3 or 1.34.1.

Is CVE-2025-46821 being exploited?

There is no known exploitation of CVE-2025-46821 in the wild and no public exploit code.

Other vulnerabilities in Envoyproxy Envoy

• CVE-2022-29226 Trivial authentication bypass in Envoy Critical 10.0
• CVE-2019-18801 Memory corruption in n/a Critical 9.8
• CVE-2019-18802 Security feature bypass in n/a Critical 9.8
• CVE-2020-35470 Information disclosure in n/a High 8.8
• CVE-2024-23324 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata High 8.6

All Envoyproxy Envoy vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-envoy-2025-46821, GHSA-c7cm-838g-6g67.