8.6

CVE-2021-39206: envoyproxy envoy Incorrect Authorization

CVSS: 8.6v3.1HighModified
AliasesGHSA-cfc2-wjcm-c8fmBIT-envoy-2021-39206
Published 09-09-2021Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2021-39206 is a high (CVSS 8.6) Incorrect Authorization vulnerability in envoyproxy envoy. EPSS estimates a 1.46% chance of exploitation in the next 30 days, higher than 73.1% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.6/10
010
High · v3.1 (CVE.org)
EPSS score
1.46%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 09-09-2021
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

1.46%

Chance of exploitation in the next 30 days

Percentile

73%

Versus all other CVEs

30-day change

0.00 pp

From 1.46% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Envoyproxy1 product
  • envoyEOL< 1.16.5 | ≥ 1.17.0, < 1.17.4 | ≥ 1.18.0, < 1.18.4 | 1.19.0
Github.com/pomerium1 product
  • pomerium≥ 0.11.0, < 0.14.8 | ≥ 0.15.0, < 0.15.1
Pomerium1 product
  • pomerium≥ 0.15.0, < 0.15.1 | ≥ 0.11.0, < 0.14.8 | 0.15.0

3 vendors · 3 products

References

6 links