VYPR
Get started
← All advisories
High severityNVD Advisory· Published Feb 19, 2026· Updated Apr 15, 2026

CVE-2026-26205

CVE-2026-26205

Description

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsed_path field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (//) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/open-policy-agent/opa-envoy-pluginGo
< 1.13.2-envoy-21.13.2-envoy-2

Affected products

1

Patches

1
58c44d4ec408

Merge commit from fork

https://github.com/open-policy-agent/opa-envoy-pluginJohan FyllingFeb 18, 2026via ghsa
commit
2 files changed · +23 −3
  • envoyauth/request.go+8 −3 modified
    @@ -112,14 +112,19 @@ func RequestToInput(req any, logger logging.Logger, protoSet *protoregistry.File
 }
 
 func getParsedPathAndQuery(path string) ([]string, map[string]any, error) {
-	parsedURL, err := url.Parse(path)
+	rawPath, rawQuery, _ := strings.Cut(path, "?")
+
+	decodedPath, err := url.PathUnescape(rawPath)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	parsedPath := strings.Split(strings.TrimLeft(parsedURL.Path, "/"), "/")
+	parsedPath := strings.Split(strings.TrimLeft(decodedPath, "/"), "/")
 
-	query := parsedURL.Query()
+	query, err := url.ParseQuery(rawQuery)
+	if err != nil {
+		return nil, nil, err
+	}
 	parsedQueryInterface := make(map[string]any, len(query))
 	for paramKey, paramValues := range query {
 		parsedQueryInterface[paramKey] = paramValues
  • envoyauth/request_test.go+15 −0 modified
    @@ -651,6 +651,21 @@ func TestParsedPathAndQuery(t *testing.T) {
 			[]string{"my", "test", "path"},
 			map[string]any{"a": []string{"1", "new\nline"}},
 		},
+		{
+			createExtReqWithPath("//x/people"),
+			[]string{"x", "people"},
+			map[string]any{},
+		},
+		{
+			createExtReqWithPath("//admin/dashboard"),
+			[]string{"admin", "dashboard"},
+			map[string]any{},
+		},
+		{
+			createExtReqWithPath("//x/people?a=1"),
+			[]string{"x", "people"},
+			map[string]any{"a": []string{"1"}},
+		},
 	}
 
 	for _, tt := range tests {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.