CVE-2026-26205
2 advisories.
Go/github.com/open-policy-agent/opa-envoy-plugin CVE-2026-26205: high
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path
Action: Upgrade github.com/open-policy-agent/opa-envoy-plugin to 1.13.2-envoy-2 or later.
go get github.com/open-policy-agent/opa-envoy-plugin@v1.13.2-envoy-2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.13.2-envoy-2 | - |
Fixed versions
| 1.13.2-envoy-2 |
Sources
- osv: GHSA-9f29-v6mm-pw6w
- https://github.com/open-policy-agent/opa-envoy-plugin/security/advisories/GHSA-9f29-v6mm-pw6w
- https://nvd.nist.gov/vuln/detail/CVE-2026-26205
- https://github.com/open-policy-agent/opa-envoy-plugin/commit/58c44d4ec408d5852d1d0287599e7d5c5e2bc5c3
- https://github.com/open-policy-agent/opa-envoy-plugin
- https://github.com/open-policy-agent/opa-envoy-plugin/releases/tag/v1.13.2-envoy-2
CVE-2026-26205 · published · modified · JSON
Go/github.com/open-policy-agent/opa-envoy-plugin CVE-2026-26205: unknown
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin
Action: Upgrade github.com/open-policy-agent/opa-envoy-plugin to 1.13.2-envoy-2 or later.
go get github.com/open-policy-agent/opa-envoy-plugin@v1.13.2-envoy-2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.13.2-envoy-2 | - |
Fixed versions
| 1.13.2-envoy-2 |
Sources
- osv: GO-2026-4506
- https://github.com/open-policy-agent/opa-envoy-plugin/security/advisories/GHSA-9f29-v6mm-pw6w
- https://nvd.nist.gov/vuln/detail/CVE-2026-26205
- https://github.com/open-policy-agent/opa-envoy-plugin/commit/58c44d4ec408d5852d1d0287599e7d5c5e2bc5c3
- https://github.com/open-policy-agent/opa-envoy-plugin/releases/tag/v1.13.2-envoy-2
CVE-2026-26205 · published · modified · JSON