{"action":"Upgrade github.com/open-policy-agent/opa-envoy-plugin to 1.13.2-envoy-2 or later.","affected":[{"fixed":"1.13.2-envoy-2","introduced":"0"}],"component":"github.com/open-policy-agent/opa-envoy-plugin","cve_ids":["CVE-2026-26205"],"ecosystem":"Go","epss":0.00534,"exploited":false,"fixed_versions":["1.13.2-envoy-2"],"ghsa_id":"GHSA-9f29-v6mm-pw6w","id":"tcs_01M5KGE4M0NRD1V2SJBMHCB8XN","modified_at":"2026-02-24T22:14:03.198652Z","published_at":"2026-02-23T18:23:12Z","references":["https://osv.dev/vulnerability/GO-2026-4506","https://github.com/open-policy-agent/opa-envoy-plugin/security/advisories/GHSA-9f29-v6mm-pw6w","https://nvd.nist.gov/vuln/detail/CVE-2026-26205","https://github.com/open-policy-agent/opa-envoy-plugin/commit/58c44d4ec408d5852d1d0287599e7d5c5e2bc5c3","https://github.com/open-policy-agent/opa-envoy-plugin/releases/tag/v1.13.2-envoy-2"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GO-2026-4506","url":"https://osv.dev/vulnerability/GO-2026-4506"},{"source":"nvd","source_id":"CVE-2026-26205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26205"}],"summary":"opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin"}