Opa Envoy Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:open-policy-agent:opa-envoy-plugin:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Open Policy Agent (0bd0ae05-989f-55d7-a7e8-b09fed608f70) |
|---|---|
| Product | Opa Envoy Plugin (9afe4c13-8f44-5d3c-a32f-dfba98442074) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-26205 |
vulnerable | 2026-06-08 07:53:21.405694 |
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.
Published: 2026-02-19T19:31:26.905Z
Updated: 2026-02-19T21:22:21.384Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.