Vulnerability Description
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.
Related Weaknesses (CWE)
References
- https://github.com/open-policy-agent/opa-envoy-plugin/commit/58c44d4ec408d5852d1
- https://github.com/open-policy-agent/opa-envoy-plugin/releases/tag/v1.13.2-envoy
- https://github.com/open-policy-agent/opa-envoy-plugin/security/advisories/GHSA-9
FAQ
What is CVE-2026-26205?
CVE-2026-26205 is a documented vulnerability. opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treat...
How severe is CVE-2026-26205?
CVSS scoring is not yet available for CVE-2026-26205. Check NVD for updates.
Is there a patch for CVE-2026-26205?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.