Envoy: stored XSS through unescaped dynamic statistic names on the admin stats page

Impact

StatsHtmlRender sanitizes statistic values but emits statistic names without HTML encoding. A data-plane filter such as grpc_stats with stats_for_all_methods enabled folds attacker-controlled path segments into cached dynamic stat names, so a remote client can persist script into the admin interface. When an operator later opens /stats?format=html in a browser, that script runs with the admin origin and can issue privileged same-origin requests to the admin API - which can reconfigure or shut down the proxy. This matters where an operator or dashboard reaches the Envoy admin port from a browser; an admin interface bound to localhost and never browsed is not exposed.

Who can reach it

Remote unauthenticated client to shape the stat name, then an operator viewing the HTML stats page in a browser. Requires the admin interface to be browser-accessible and a component that persists attacker-influenced text in stat names.

What to do

Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4 or 1.39.1 and restart the proxy. Meanwhile disable stats_for_all_methods on grpc_stats, keep the admin interface off any browser-reachable network, and read stats via the JSON or Prometheus formats rather than HTML.

References

Related entries

• Istio: Authentication Policy exact-path matching allows unauthorized access to HTTP pathsCVE-2020-8595 · IstioHigh
• containerd: Overly broad default permissions on containerd-managed directoriesCVE-2024-25621 · containerdHigh
• runc: Insufficient verification of masked-path bind mounts (/dev/null replaced by symlink) enables containerCVE-2025-31133 · runcHigh
• runc: Attacker misdirects runc writes to /proc via racing symlinksCVE-2025-52881 · runcHigh
• Traefik: Path traversal in the WASM plugin installation mechanismCVE-2025-54386 · TraefikHigh
• KubeVirt: safepath OpenAtNoFollow resolves via /proc/self/fd, defeating the symlink protectionCVE-2026-13201 · KubeVirtHigh