CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, dagger, manifest-tool, eksctl, helm-set-status, osv-scanner, chartmuseum, steampipe, tigera-operator, rancher, envoy-gateway, linkerd2, tw, gatekeeper, k3s, fuse-overlayfs-snapshotter, headlamp, opa-envoy, spegel, syft, trivy-operator, wolfictl,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: kaniko-fips, zot, kots, k9s-fips, tigera-operator, cluster-api-helm-controller, rancher-helm, tigera-operator-fips, jfrog-cli, linkerd2-fips, trivy-fips, zarf-fips, chainctl-fips, consul-k8s-fips, headlamp, cloudbeat, teleport, cloudbeat-fips, tw, cg,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: migrate, opentelemetry-collector, chezmoi, docker-credential-ecr-login, nats, doppler-kubernetes-operator, crossplane-provider-sql, rqlite, terraform-provider-azapi, gh, crossplane-provider-azure-authorization, flux-image-automation-controller,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: migrate, bom, envconsul, helm-set-status, kubernetes-csi-external-attacher, flannel, spire-server, smarter-device-manager, crossplane-provider-sql, fuse-overlayfs-snapshotter, redpanda, spegel, syft, timoni, dkron, terraform-provider-azapi, gh, dapr,...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-envoy, opa-fips-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy, opa-fips-envoy...

GO-2026-4506 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsedpath in github.com/open-policy-agent/opa-envoy-plugin...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

CVE-2026-26205 affects the opa-envoy-plugin for Envoy (opa-envoy-plugun). Versions prior to 1.13.2-envoy-2 construct input.parsed_path by treating HTTP request paths as full URIs and interpreting leading segments with ‘//’ as authorities, which drops those segments from the parsed path. This crea...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

opa-envoy-plugin 安全漏洞

opa-envoy-plugin is a plugin developed by Open Policy Agent. Versions of opa-envoy-plugin prior to 1.13.2-envoy-2 contained security vulnerabilities. These vulnerabilities stemmed from defects in the way the input.parsedpath field was constructed, which could lead to mismatches in path...

GHSA-9F29-V6MM-PW6W opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: migrate, kubeflow-pipelines, gomplate, chezmoi, docker-credential-ecr-login, nats, doppler-kubernetes-operator, crossplane-provider-sql, terraform-provider-azapi, gh, conftest, terraform-provider-acme, flux-image-automation-controller, docker-credential-acr-env,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: neuvector-scanner, dagger, eksctl, osv-scanner, flux-source-controller, chartmuseum, envoy-gateway, linkerd2, k3s, fuse-overlayfs-snapshotter, opa-envoy, spegel, syft, wolfictl, skaffold, kubevela, newrelic-infrastructure-agent, nerdctl, xeol, kargo, k8ssandra-client...