CVE-2026-73546
Description
A flaw was found in Envoy. The administrative HTML statistics interface does not properly encode dynamic statistic names before displaying them, leading to a stored cross-site scripting (XSS) vulnerability. A remote attacker can exploit this by sending crafted requests that cause Envoy to store malicious script content within dynamically generated statistic names. When an administrator accesses the statistics page in a web browser, the injected code executes with administrative permissions, potentially allowing the attacker to perform unauthorized actions or access sensitive administrative data.
Statement
This vulnerability is rated as Important severity because an unauthenticated network attacker sending crafted requests can inject persistent script content into metric identifiers, which executes in the context of the administrative control interface. In Red Hat OpenShift Service Mesh and Red Hat Insights environments using Envoy, this enables stored cross-site scripting attacks that can compromise administrator sessions and trigger privileged control operations. The risk is elevated over Moderate due to the high confidentiality and integrity impact on the management plane, though successful exploitation depends on filter configurations generating dynamic metric names and an operator viewing the HTML interface via an interactive web browser.
Mitigation
To mitigate exposure without patching, apply the following operational and configuration controls:
1. Restrict administrative interface reachability: Isolate the Envoy administrative interface (typically listening on port 15000 in OpenShift Service Mesh deployments). Ensure it is accessible only via localhost or strictly controlled internal networks by applying OpenShift NetworkPolicies or firewall rules.
2. Avoid interactive browser access to HTML stats: Do not render `/stats?format=html` in an interactive web browser. Use automated metric collectors or command-line tools to query text or JSON representations instead (e.g., `curl http://localhost:15000/stats` or `curl http://localhost:15000/stats?format=json`).
3. Reconfigure dynamic metric filters: Avoid configurations and extensions that generate dynamic statistic names based on untrusted incoming traffic, such as disabling `stats_for_all_methods` in gRPC stats filters.
Caveats: Restricting the admin port may disrupt external monitoring tools or custom diagnostic automation that query the management interface. Reconfiguring Envoy proxy settings requires restarting or reloading proxy instances, which may briefly interrupt active network sessions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 7.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat CVSS v3 Score Explanation
Adopting upstream CVSS for coordinated disclosure
Understanding the Weakness (CWE)
Access Control,Confidentiality
Technical Impact: Bypass Protection Mechanism; Read Application Data
The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, "drive-by hacking."
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data
The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
