CVE-2026-73546: Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpcstats with statsforallmethods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.36.10 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.37.6 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.38.4 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.39.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires the Envoy admin interface to be accessible from a browser and an enabled component to persist attacker-influenced text in statistic names. One cited example is grpc_stats with stats_for_all_methods enabled, where path segments can be incorporated into cached dynamic statistic names.
What must an attacker do to exploit the vulnerability?
An attacker must cause attacker-controlled text to be stored in a statistic name, then an operator must view /stats?format=html in a browser. The resulting script executes under the admin interface origin and can make privileged same-origin requests.
Are all Envoy stats pages affected?
The issue specifically affects the HTML rendering path at /stats?format=html, where statistic names are emitted without HTML encoding. It depends on attacker-influenced statistic names being persisted; sanitization of string statistic values does not prevent this condition.
Which versions contain the fix?
The issue is fixed in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Versions prior to those releases are affected under the stated exposure conditions.