CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: consul-k8s, skaffold, xeol, kaniko, helm-operator, k8ssandra-client, neuvector-scanner, docker, steampipe, fuse-overlayfs-snapshotter, kubescape, k3s, zarf, docker-compose, spegel, cluster-api-helm-controller, kargo, kots, headlamp, linkerd2, containerd,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, scorecard, helm-push, datadog-agent-fips, cloudbeat, zarf, k9s, buildkitd-fips, kubescape-operator, neuvector-fips, headlamp-fips, spegel, amazon-ecs-agent, linkerd2, kubescape-server, k8ssandra-client-fips, dagger, kots, kube-mgmt,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, cloudnative-pg, crossplane-provider-azure-authorization, coredns, prometheus-adapter, wal-g, kubernetes-csi-node-driver-registrar, libnvidia-container, otel-cli, delve, flux-notification-controller, witness, golangci-lint, kpt, rclone,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: coredns, clickhouse-operator, prometheus-adapter, pdfcpu, flux-notification-controller, kpt, newrelic-infra-operator, k3d, pvc-autoresizer, kube-arangodb, go-licenses, helm-mapkubeapis, nri-consul, yunikorn-web, nri-f5, mariadb-operator, descheduler, seaweedfs,...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-envoy, opa-fips-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy, opa-fips-envoy...

GO-2026-4506 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsedpath in github.com/open-policy-agent/opa-envoy-plugin...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

CVE-2026-26205 affects the opa-envoy-plugin for Envoy (opa-envoy-plugun). Versions prior to 1.13.2-envoy-2 construct input.parsed_path by treating HTTP request paths as full URIs and interpreting leading segments with ‘//’ as authorities, which drops those segments from the parsed path. This crea...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

opa-envoy-plugin 安全漏洞

opa-envoy-plugin is a plugin developed by Open Policy Agent. Versions of opa-envoy-plugin prior to 1.13.2-envoy-2 contained security vulnerabilities. These vulnerabilities stemmed from defects in the way the input.parsedpath field was constructed, which could lead to mismatches in path...

GHSA-9F29-V6MM-PW6W opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: coredns, clickhouse-operator, prometheus-adapter, pdfcpu, flux-notification-controller, kpt, newrelic-infra-operator, grafana-alloy, k3d, metrics-server, k9s, pvc-autoresizer, kube-arangodb, go-licenses, secrets-store-csi-driver-provider-gcp, helm-mapkubeapis,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: skaffold, xeol, kaniko, helm-operator, k8ssandra-client, neuvector-scanner, docker, fuse-overlayfs-snapshotter, kubescape, k3s, melange, zarf, docker-compose, spegel, cluster-api-helm-controller, kargo, kots, linkerd2, docker-cli-buildx, buildkitd, helm-push, nerdctl...