Log in Start free

Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M

CVE-2026-26205opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

High 7.1

In plain English

A high-severity incorrect authorization in opa-envoy-plugin from open-policy-agent. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.5%top 54.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/open-policy-agent/opa-envoy-plugin1.13.2-envoy-2GHSA-9f29-v6mm-pw6w
Gogithub.com/open-policy-agent/opa-envoy-plugin1.13.2-envoy-2GO-2026-4506

Affected products (as reported)

VendorProductVersions
open-policy-agent opa-envoy-plugin < 1.13.2-envoy-2

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

References