20 matches found
CVE-2026-46680 vulnerabilities
Vulnerabilities for packages: rancher-helm, k9s, k8ssandra-client, fuse-overlayfs-snapshotter, tigera-operator, teleport, rancher, gogatekeeper, kubevela, zarf, dagger, kargo, chartmuseum, scorecard, ctop, k8sgpt, zot, wolfictl, helm-mapkubeapis, helm-push, helm, manifest-tool, linkerd2, syft,...
CVE-2026-46680 vulnerabilities
Vulnerabilities for packages: chartmuseum, syft-fips, chartmuseum-fips, zarf, grype, kubevela-fips, eks-node-monitoring-agent-fips, headlamp, kubescape-server, k3s, xeol-fips, gitlab-rails-ce-fips, cluster-api-helm-controller-fips, opa, helm-fips, trivy-operator, linkerd2-fips, dagger, docker-fip...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: aws-load-balancer-controller, external-secrets-operator, rancher-system-upgrade-controller, knative-eventing, argo-rollouts, chartmuseum, falco-no-driver, aws-application-networking-k8s, cluster-api-provider-vsphere, dex, metacontroller, nri-f5, runc, cosign,...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: gitness, terraform-provider-random, external-secrets-operator, cloud-provider-azure, sftpgo, opentelemetry-operator, cluster-api, docker-machine-driver-harvester, kserve-modelmesh-serving, docker-machine-driver-linode, knative-eventing, argo-rollouts,...
GHSA-9F29-V6MM-PW6W vulnerabilities
Vulnerabilities for packages: opa-envoy...
CVE-2026-26205 vulnerabilities
Vulnerabilities for packages: opa-envoy...
CVE-2026-26205 vulnerabilities
Vulnerabilities for packages: opa-envoy, opa-fips-envoy...
GHSA-9F29-V6MM-PW6W vulnerabilities
Vulnerabilities for packages: opa-envoy, opa-fips-envoy...
GO-2026-4506 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsedpath in github.com/open-policy-agent/opa-envoy-plugin...
CVE-2026-26205
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...
CVE-2026-26205
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...
CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...
CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...
CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...
CVE-2026-26205
CVE-2026-26205 affects the opa-envoy-plugin for Envoy (opa-envoy-plugun). Versions prior to 1.13.2-envoy-2 construct input.parsed_path by treating HTTP request paths as full URIs and interpreting leading segments with ‘//’ as authorities, which drops those segments from the parsed path. This crea...
opa-envoy-plugin 安全漏洞
opa-envoy-plugin is a plugin developed by Open Policy Agent. Versions of opa-envoy-plugin prior to 1.13.2-envoy-2 contained security vulnerabilities. These vulnerabilities stemmed from defects in the way the input.parsedpath field was constructed, which could lead to mismatches in path...
GHSA-9F29-V6MM-PW6W opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path
A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path
A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: aws-load-balancer-controller, external-secrets-operator, gogatekeeper, cluster-api-azure-controller, rancher-system-upgrade-controller, knative-eventing, argo-rollouts, chartmuseum, falco-no-driver, aws-application-networking-k8s, cluster-api-provider-vsphere, dex,...
GHSA-265R-HFXG-FHMG vulnerabilities
Vulnerabilities for packages: k8ssandra-client, fuse-overlayfs-snapshotter, kubevela, zarf, dagger, kargo, melange, chartmuseum, ctop, k8sgpt, zot, wolfictl, helm-push, flux-helm-controller, helm, linkerd2, syft, grype, opa, cert-manager-cmctl, gatekeeper, buildkitd, kaniko, osv-scanner,...