onyx --cves cve-2026-73546
CVE-2026-73546
- score
- 12.7
- cvss
- 7.4
- epss
- 0.6%
- published
- 2026-09-21
- kev added
- —
- first seen
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains a stored XSS caused by unencoded statistic names in /stats?format=html admin endpoint, letting attackers execute scripts in admin interface, exploit requires browser-accessible admin interface and enabled component persisting attacker data.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 9
- https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8
- https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83
- https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
- https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
- https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
- https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
- https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f
- https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg