{"action":"Upgrade github.com/open-policy-agent/opa-envoy-plugin to 1.13.2-envoy-2 or later.","affected":[{"fixed":"1.13.2-envoy-2","introduced":"0"}],"component":"github.com/open-policy-agent/opa-envoy-plugin","cve_ids":["CVE-2026-26205"],"ecosystem":"Go","epss":0.00958,"exploited":false,"fixed_versions":["1.13.2-envoy-2"],"ghsa_id":"GHSA-9f29-v6mm-pw6w","id":"tcs_01M5KF5EB386XM85WQKA6KC5V4","modified_at":"2026-09-10T03:50:34.621591749Z","published_at":"2026-02-18T15:25:04Z","references":["https://osv.dev/vulnerability/GHSA-9f29-v6mm-pw6w","https://github.com/open-policy-agent/opa-envoy-plugin/security/advisories/GHSA-9f29-v6mm-pw6w","https://nvd.nist.gov/vuln/detail/CVE-2026-26205","https://github.com/open-policy-agent/opa-envoy-plugin/commit/58c44d4ec408d5852d1d0287599e7d5c5e2bc5c3","https://github.com/open-policy-agent/opa-envoy-plugin","https://github.com/open-policy-agent/opa-envoy-plugin/releases/tag/v1.13.2-envoy-2"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-9f29-v6mm-pw6w","url":"https://osv.dev/vulnerability/GHSA-9f29-v6mm-pw6w"}],"summary":"opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path"}