https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T00:12:47.880753+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-268896 EUVD-2026-268896 2026-10-08T00:12:47.918539+00:00 EUVD-2026-268896 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26205 fkie_cve-2026-26205 2026-10-08T00:12:47.918583+00:00

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-9f29-v6mm-pw6w GHSA-9f29-v6mm-pw6w — opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path 2026-10-08T00:12:47.918622+00:00

Affected: Go: github.com/open-policy-agent/opa-envoy-plugin

A security vulnerability has been discovered in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as [authority](https://datatracker.ietf.org/doc/html/rfc3986#section-3.2) components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served.

#### Attack example

**HTTP request:**

``` GET //admin/users HTTP/1.1 Host: example.com ```

**Policy sees:**

The leading `//admin` path segment is interpreted as an authority component, and dropped from `input.parsed_path` field:

```json { "parsed_path": ["users"] } ```

**Backend receives:**

`//admin/users` path, normalized to `/admin/users`.

#### Affected Request Pattern Examples

| Request path | `input.parsed_path` | `input.attributes.request.http.path` | Discrepancy | | - | - | - | - | | / | [""] | / | ✅ None | | //foo | [""] | //foo| ❌ Mismatch | | /admin | ["admin"] | /admin | ✅ None | | /admin/users | ["admin", "users"] | /admin/users | ✅ None | | //admin/users | ["users"] | //admin/users | ❌ Mismatch |

### Impact

Users are impacted if all the following conditions apply:

1. Protected resources are path-hierarchical (e.g., `/admin/users` vs `/users`)…