CVE-2021-29492

score

<0.1

cvss

8.1

epss

66.2%

published

2021-05-28

kev added

—

first seen

2026-10-21

Envoy versions 1.18.2 and before do not decode escaped slash sequences `%2F` and `%5C` in URL paths, allowing remote attackers to craft paths that bypass access control policies, potentially leading to privilege escalation. Exploit requires sending URL paths with escaped slashes from untrusted clients.