CVE-2026-73546

{
  "etk_id": "ETK-2026-2531",
  "cve_id": "CVE-2026-73546",
  "display_id": "CVE-2026-73546",
  "ghsa_id": "GHSA-pv9h-4fxf-7vrg",
  "euvd_id": "EUVD-2026-84114",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Envoy admin statistics",
  "summary": "Envoy versions before the fixed releases may include unescaped statistic names in the HTML administration statistics page. An attacker able to influence persisted statistic names can run script in the context of the admin interface when an operator views that page, if the interface is browser-accessible and relevant dynamic statistics collection is enabled.",
  "mitigation": "Upgrade Envoy to 1.39.1, 1.38.4, 1.37.6, 1.36.10 or later.",
  "vendor": "envoyproxy",
  "product": "envoy proxy:Envoy",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<1.40.0"
      ],
      "ecosystem": "envoy proxy",
      "fixed_versions": [
        "1.39.1",
        "1.38.4",
        "1.37.6",
        "1.36.10"
      ],
      "package_name": "Envoy",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 9.249894316666667,
  "t0_at": "2026-09-21T19:53:21.443000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-23T00:26:33.649958+00:00",
      "days": 31.189724617569443,
      "is_lower_bound": false,
      "measured_at": "2026-09-21T19:53:21.443000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-21T19:53:21.443000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-21T19:53:21.443000+00:00",
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg"
    }
  }
}