PYSEC-2026-1361 OpaMiddleware does not filter HTTP OPTIONS requests

Summary HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...

BIT-APISIX-2026-49231 Apache APISIX: Identity spoofing issue in APISIX opa plugin

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX:...

CVE-2026-49231

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX:...

CVE-2026-49231 Apache APISIX: Identity spoofing issue in APISIX opa plugin

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX:...

CVE-2026-49231

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX:...

EUVD-2026-38020

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX:...

CVE-2026-49231

CVE-2026-49231 describes an authentication bypass via spoofed identity headers in the APISIX opa plugin. Affected software: Apache APISIX (versions 3.5.0–3.16.0). Root cause: spoofed headers accepted due to non-default plugin configuration, allowing an attacker to relay identities to an upstream ...

PT-2026-50896

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.5.0 through 3.16.0 Description An authentication bypass issue exists in the opa plugin. An attacker can relay spoofed identity headers to upstream services by exploiting non-default configurations in the opa plugin,...

CVE-2026-49231: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX:...

CVE-2026-39821 affecting package opa for versions less than 0.63.0-4

CVE-2026-39821 affecting package opa for versions less than 0.63.0-4. A patched version of the package is available...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: rancher, containerd, datadog-agent, k3s, trivy-operator, wolfictl, kubescape, linkerd2, rancher-agent, teleport, kubescape-operator, buildkitd, ctop, helm-push, helm-mapkubeapis, dagger, helm, helm-operator, opa, falco-no-driver, syft, eksctl, helm-set-status, zarf,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: opa-envoy, cloudbeat, zarf-fips, gitlab-rails-ce-fips, kubescape, gitlab-rails-ce, kubevela, chaos-mesh-fips, docker-compose, kubevela-fips, containerd-fips, consul-k8s, grype-fips, grype, k8ssandra-client-fips, trivy-operator-fips, spegel-fips, helm, rancher-agent,...

AZL-88161 CVE-2026-39821 affecting package opa for versions less than 0.63.0-4

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

OPENSUSE-SU-2026:10755-1 opa-1.16.2-1.1 on GA media

These are all security issues fixed in the opa-1.16.2-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, verticadb-operator, cosign, prometheus-adapter, hubble, cilium, mesosphere-vsphere-csi, rancher-agent, temporal, cloud-provider-vsphere, crossplane-provider-azure-storage, aactl, vexctl, crossplane-provider-sql, yunikorn-k8shim, opencost,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: nri-mssql, rancher-telemetry, cosign, cloud-provider-vsphere, crossplane-provider-sql, metrics-agent, gitleaks, step-ca, kpt, authservice, knative-client, lvm-driver, external-dns, stern, terraform-provider-kubernetes, spark-operator, flux-notification-controller,...

CVE-2025-11065 affecting package opa for versions less than 0.63.0-3

CVE-2025-11065 affecting package opa for versions less than 0.63.0-3. A patched version of the package is available...

CVE-2025-11065 affecting package opa for versions less than 0.63.0-6

CVE-2025-11065 affecting package opa for versions less than 0.63.0-6. A patched version of the package is available...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: opa-envoy, cloudbeat, crossplane-provider-aws-ecs-fips, crossplane-provider-terraform, vertical-pod-autoscaler, crossplane-provider-aws-cloudfront, flux-source-watcher-fips, apache-beam-python-3.11-sdk, grafana-alloy-fips, grafana-alloy, kubo-fips, mattermost-fips,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: opa-envoy, cloudbeat, crossplane-provider-aws-ecs-fips, crossplane-provider-terraform, vertical-pod-autoscaler, crossplane-provider-aws-cloudfront, flux-source-watcher-fips, apache-beam-python-3.11-sdk, grafana-alloy-fips, grafana-alloy, kubo-fips, mattermost-fips,...