Envoy versions 1.0 through 1.33.0 contain an injection vulnerability in the Query Parameter Handler, specifically in the params.add function of source/extensions/filters/http/header_mutation/header_mutation.cc. This weakness can be remotely exploited to perform injection attacks. The vulnerability is tracked as CVE-2026-6994 with a CVSS 4.0 base score of 5.3 (medium severity). A patch commit has been identified, suggesting that a fix is available, though no formal remediation level or vendor advisory is provided.

The vulnerability allows remote attackers to inject malicious input via query parameters handled by Envoy, potentially leading to unintended behavior or compromise within the affected component. The CVSS score of 5.3 indicates a moderate impact with low attack complexity and no required user interaction. There are no reports of active exploitation in the wild.

A patch identified by commit f8f4f1e02fdc64ecd4acf2d903208dd7285ad3a4 addresses this issue. It is recommended to apply this patch or upgrade to a version of Envoy that includes this fix. Since no official vendor advisory or remediation level is provided, users should monitor Envoy project communications for formal updates. Patch status is not yet confirmed by an official advisory; therefore, check the vendor's resources for current remediation guidance.