Bug 2512092 (CVE-2026-73546)

Summary: CVE-2026-73546 envoy: envoy: stored XSS through dynamically generated stat names in admin interface
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: kaycoth, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Envoy. The administrative HTML statistics interface does not properly encode dynamic statistic names before displaying them, leading to a stored cross-site scripting (XSS) vulnerability. A remote attacker can exploit this by sending crafted requests that cause Envoy to store malicious script content within dynamically generated statistic names. When an administrator accesses the statistics page in a web browser, the injected code executes with administrative permissions, potentially allowing the attacker to perform unauthorized actions or access sensitive administrative data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-08-26   

Description OSIDB Bzimport 2026-08-06 15:01:32 UTC 
A stored cross-site scripting issue in the HTML stats interface. Extensions that create dynamically named statistics could introduce attacker-controlled content into /stats?format=html. The fix properly escapes stat names during HTML generation.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4)

Embargoed until 2026-08-26 13:00 GMT per Envoy upstream disclosure. PSIRTSUPT-21132.