High, CVSS 7.1GoPublished
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path
CVE-2026-26205 · GHSA-9f29-v6mm-pw6w
- Affected
- Go github.com/open-policy-agent/opa-envoy-plugin <= 1.13.1-envoy
- Fixed in
- 1.13.2-envoy-2· Vendor fix available
- Issue
- A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (//) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Attack example HTTP request: Policy sees: The leading //admin path segment is interpreted as an authority component, and dropped from input.parsedpath field: Backend receives: //admin/users path, normalized to /admin/users. Affected Request Pattern Examples | Request path | input.parsedpath | input.attributes.request.http.path | Discrepancy | | - | - | - | - | | / | [""] | / | ✅ None | | //foo | [""] | //foo| ❌ Mismatch | | /admin | ["admin"] |…
Recommended action: Upgrade to 1.13.2-envoy-2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.