The vulnerability arises when Envoy’s ignore_path_parameters_in_path_matching option is enabled. With this flag, the router strips semicolon‐suffix path parameters before routing, but the RBAC URL path matcher continues to evaluate the raw, uncanonicalized path. A crafted request such as /admin;x can therefore satisfy the router’s route match for /admin while bypassing the RBAC DENY rule aimed at /admin, granting an unauthenticated client access to protected resources. This flaw represents a combination of improper authorization (CWE‑863) and insecure path handling (CWE‑436).

The issue affects Envoy proxy deployments that have the ignore_path_parameters_in_path_matching option enabled and use a path‑based RBAC rule. All versions of Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are vulnerable. Any configuration that enables this feature while protecting a route with a RBAC rule must be considered at risk until the vendor releases the specified fixed releases.

The CVSS score of 7.5 signals high severity. EPSS data is not available and the vulnerability isn’t listed in the CISA KEV catalog, so known exploitation evidence is lacking. The likely attack vector is an unauthenticated HTTP request that includes semicolon‑separated path parameters, exploiting the canonicalization mismatch to bypass RBAC. While exploitation potential is limited to configurations that combine the problematic option with matching RBAC rules, the impact can be significant if an attacker gains access to sensitive backends.