cloud-native

Envoy v1.38.6 releases security fixes for oauth2 and api_key_auth

Brief written by the FOSSWire AI editor from Envoy Cloud-Native Edge Proxy

October 6, 2026 1 min read Impact: 5/10

Key Takeaway

Envoy v1.38.6 addresses two security vulnerabilities that could cause crashes during CONNECT requests.

Summary

The Envoy proxy has released version 1.38.6 to address two specific security vulnerabilities. These fixes prevent service crashes triggered by requests lacking a :path header, such as CONNECT requests, when using oauth2 or api_key_auth filters.

Security vulnerability details

GHSA-8vc2-jrm4-835w: Fixed a crash in the oauth2 filter when processing requests without a :path header (e.g., CONNECT requests); these are now rejected with a 400 error.
GHSA-47vj-9r25-wv5j: Fixed a crash in api_key_auth occurring when hide_credentials is enabled with a query key source and a request without a :path header is authenticated via a different key source.

Original reference: github.com →