CVE-2026-73546 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
Attackers can inject scripts into Envoy's admin stats page via dynamic statistic names, allowing script execution in the admin interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73546?
CVE-2026-73546 is a high-severity cross-site scripting vulnerability in Envoyproxy Envoy, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-73546?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.36.10, 1.37.6, 1.38.4, 1.39.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2026-73546?
Upgrade envoy to a fixed version for your release line: 1.36.10, 1.37.6, 1.38.4 or 1.39.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73546 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73546 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2026-73546, GHSA-pv9h-4fxf-7vrg, MINI-6qc8-344g-g2mp, MINI-77w5-r62w-7789, MINI-m7rc-wq8f-wgv4, MINI-xqm3-hv3v-p284.