CVE-2026-107492: Critical severity vulnerability
Improper Authentication in the jwtauthn HTTP filter in envoyproxy envoy versions up to and including 1.38.0 allows an unauthenticated attacker to bypass JWT requirements by sending a duplicate trigger header. When a JWT requirement is scoped to a specific header, supplying that header twice with any second value causes the requirement to silently not apply, allowing the request to reach the upstream backend without any token check.
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using Envoy's jwt_authn HTTP filter are exposed when a JWT requirement is scoped to a specific request header. The affected versions are Envoy releases up to and including 1.38.0.
What must an attacker send to bypass the JWT check?
An unauthenticated attacker must send the header that triggers the scoped JWT requirement twice. The second instance can have any value, causing the requirement not to apply and allowing the request to reach the upstream backend without token validation.
Are JWT requirements that are not scoped to a specific header affected?
The provided information identifies the bypass only for JWT requirements scoped to a specific header. It does not establish impact for other JWT requirement configurations.