CVE-2026-47778 Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)
Attackers can bypass TLS certificate validation by using embedded NUL bytes in DNS SANs, allowing unauthorized upstream routing.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47778?
CVE-2026-47778 is a medium-severity authentication bypass vulnerability in Envoyproxy Envoy, published on 26 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm. If the attacker serves a certificate with a dNSName SAN containing an embedded NUL byte, the helper Utility::generalNameAsString captures the complete string including the NUL. However, when .c_str() evaluates it, implicit conversion to absl::string_view inside dnsNameMatch relies on strlen(), prematurely truncating the evaluation context. Envoy evaluates trucated string against the exact required config_san match and returns true, thereby successfully validating the string with the Nul byte for an upstream routing. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Weakness: CWE-158
Which versions are affected by CVE-2026-47778?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.35.11, 1.36.7, 1.37.3, 1.38.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2026-47778?
Upgrade envoy to a fixed version for your release line: 1.35.11, 1.36.7, 1.37.3 or 1.38.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-47778 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47778 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2026-47778, GHSA-f8x4-rw5x-f3r7.