Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody. - Affected versions: = 0.27.33 current HEAD...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: kubescape-operator, kubescape, xeol, containerd, gogatekeeper, headlamp, neuvector-scanner, rancher, k3s, eksctl, grype, helm-push, k8ssandra-client, k8sgpt, kubevela, docker, helm, spegel, ctop, scorecard, kube-arangodb, tw, falco-no-driver, kaniko, rancher-agent,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, datadog-agent-fips, headlamp-fips, rancher-agent, kube-mgmt, headlamp, kube-mgmt-fips, xeol-fips, k8ssandra-client-fips, falco-no-driver, amazon-ecs-agent-fips, opa-envoy, fuse-overlayfs-snapshotter, ctop, docker, docker-compose-fips,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: bank-vaults, cluster-autoscaler, neuvector-scanner, rancher-telemetry, keda, cilium, aws-nuke, authservice, harbor-scanner-trivy, nerdctl, nri-kafka, mc, falco-no-driver, grafana-mimir, nri-redis, mesosphere-vsphere-csi, kubernetes-csi-external-attacher, cert-exporte...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: k8ssandra-operator, step-ca, hubble-ui, newrelic-fluent-bit-output, bank-vaults, cluster-autoscaler, grafana-agent-operator, k8sgpt-operator, aws-efs-csi-driver, otel-cli, libnvidia-container, neuvector-scanner, timoni, trillian, memcached-exporter, polaris,...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GO-2026-4506 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsedpath in github.com/open-policy-agent/opa-envoy-plugin...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

CVE-2026-26205 affects the opa-envoy-plugin for Envoy (opa-envoy-plugun). Versions prior to 1.13.2-envoy-2 construct input.parsed_path by treating HTTP request paths as full URIs and interpreting leading segments with ‘//’ as authorities, which drops those segments from the parsed path. This crea...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

opa-envoy-plugin security vulnerabilities

opa-envoy-plugin is a plugin developed by Open Policy Agent. Versions of opa-envoy-plugin prior to 1.13.2-envoy-2 contained security vulnerabilities. These vulnerabilities stemmed from defects in the way the input.parsedpath field was constructed, which could lead to mismatches in path...

CVE-2026-26205: Incorrect Authorization

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...