Envoy’s HTTP Role‑Based Access Control engine uses the RE2 regex library to evaluate header values that are matched by safe_regex expressions. When a request header contains RFC‑valid opaque bytes followed by an additional obs‑text octet, RE2’s UTF‑8 subject semantics incorrectly treat the match as a failure. The resulting false negative causes the RBAC policy to believe the header does not meet the deny condition and therefore forwards the request to a route that was intended to be blocked. This flaw allows an attacker to craft header values that bypass configured access controls and reach protected services, enabling unauthorized access.

The vulnerability is present in all deployments of the Envoy proxy that run any of the following pre‑release versions: 1.36 (before 1.36.10), 1.37 (before 1.37.6), 1.38 (before 1.38.4), and 1.39 (before 1.39.1) when HTTP RBAC rules employ the safe_regex matcher. Environment customers using the envoyproxy:envoy product should check the specific version and RBAC configuration to determine exposure.

The CVSS score of 7.5 indicates a high severity condition. Exploitation requires only the ability to send a crafted HTTP request that includes an obs‑text byte in an opaque header; no local privilege escalation is needed. The EPSS data is not available, and the flaw is not yet listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread exploitation has been documented. Nonetheless, the possibility of an attacker bypassing strict RBAC rules presents a serious risk. The likely attack vector is a remote HTTP client capable of manipulating header values, such as a malicious user or automated system.