EUVD-2026-268896

fkie_cve-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.

GHSA-9f29-v6mm-pw6w — opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

Affected: Go: github.com/open-policy-agent/opa-envoy-plugin

A security vulnerability has been discovered in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as [authority](https://datatracker.ietf.org/doc/html/rfc3986#section-3.2) components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served.

#### Attack example

**HTTP request:**

``` GET //admin/users HTTP/1.1 Host: example.com ```

**Policy sees:**

The leading `//admin` path segment is interpreted as an authority component, and dropped from `input.parsed_path` field:

```json { "parsed_path": ["users"] } ```

**Backend receives:**

`//admin/users` path, normalized to `/admin/users`.

#### Affected Request Pattern Examples

### Impact

Users are impacted if all the following conditions apply:

1. Protected resources are path-hierarchical (e.g., `/admin/users` vs `/users`)…

Most recent entries from all

EUVD-2026-268896

fkie_cve-2026-26205

GHSA-9f29-v6mm-pw6w — opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path