Description
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.
INFO
Published Date :
2026-02-19T19:31:26.905Z
Last Modified :
2026-02-19T21:22:21.384Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-26205 vulnerability.
| Vendors | Products |
|---|---|
| Open-policy-agent |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-26205.
