opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-policy-agent | opa-envoy-plugin | before 1.13.2-envoy-2 | 1.13.2-envoy-2 | Patch available | CNA |
| — | github.com/open-policy-agent/opa-envoy-plugin (Go) | before 1.13.2-envoy-2 | 1.13.2-envoy-2 | Patch available | GHSA-9f29-v6mm-pw6w |
- opa-envoy-plugin Vendoropen-policy-agent Affected before 1.13.2-envoy-2 Fixed in 1.13.2-envoy-2 Patch available CNA
- github.com/open-policy-agent/opa-envoy-plugin (Go) Vendor— Affected before 1.13.2-envoy-2 Fixed in 1.13.2-envoy-2 Patch available GHSA-9f29-v6mm-pw6w
Remediation
- Fix · CNA opa-envoy-plugin (open-policy-agent) Fixed in 1.13.2-envoy-2
- Fix · GHSA-9f29-v6mm-pw6w github.com/open-policy-agent/opa-envoy-plugin (Go) Fixed in 1.13.2-envoy-2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-26205
- 2026-10-03 Alias added: GHSA-9f29-v6mm-pw6w
- 2026-10-25 EPSS moved to the below the 50th percentile
References
Other 4
- https://github.com/open-policy-agent/opa-envoy-plugin/security/advisories/GHSA-9f29-v6mm-pw6w
- https://github.com/open-policy-agent/opa-envoy-plugin/commit/58c44d4ec408d5852d1d0287599e7d5c5e2bc5c3
- https://github.com/open-policy-agent/opa-envoy-plugin/releases/tag/v1.13.2-envoy-2
- https://github.com/open-policy-agent/opa-envoy-plugin
More open-policy-agent vulnerabilities
- TI-2022-16508 OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions CVSS 3.1CRITICAL 9.8
- TI-2022-07681 Array literal misordering in github.com/open-policy-agent/opa CVSS 3.1MEDIUM 6.3
- TI-2022-14552 An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers… CVSS 3.1HIGH 7.5
- TI-2025-29282 OPA server Data API HTTP path injection of Rego CVSS 4.0HIGH 7.4
- TI-2022-11544 An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the… CVSS 3.1HIGH 7.5
- TI-2024-07657 OPA SMB Force-Authentication CVSS 3.1HIGH 7.3
Sources
- CVE-2026-26205 · CVE Program
- CVE-2026-26205 · NVD
- FIRST EPSS
- GHSA-9f29-v6mm-pw6w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences