GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, buildkitd, helm, eksctl, headlamp, tigera-operator, trivy-operator, k8sgpt, dagger, docker-cli-buildx, k8ssandra-client, steampipe, trivy, docker, helm-mapkubeapis, helm-set-status, zot, spegel, skaffold, linkerd2,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: buildkitd, gitlab-rails-ce, chartmuseum-fips, gatekeeper, amazon-ecs-agent, kubescape-operator, newrelic-infrastructure-agent-fips, tigera-operator, neuvector-scanner, grype-fips, kube-arangodb, opa-envoy, helm-fips, trivy, spegel, redpanda-operator, docker-fips,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: nats-server, rancher-webhook, falcoctl, cluster-autoscaler, gitlab-kas, cloud-provider-azure, vault-secrets-webhook, nri-prometheus, step, k8s-device-plugin, sriov-network-device-plugin, chartmuseum, grafana-operator, kube-vip, otel-cli, scorecard,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: libnvidia-container, aws-flb-kinesis, falcoctl, flux-helm-controller, fscrypt, cri-tools, grafana-mimir, secrets-store-csi-driver-provider-aws, jitsucom-bulker, gatus, spqr, cluster-autoscaler, aws-flb-firehose, task, gitlab-pages, docker-cli-buildx, harbor,...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GO-2026-4506 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsedpath in github.com/open-policy-agent/opa-envoy-plugin...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

CVE-2026-26205 affects the opa-envoy-plugin for Envoy (opa-envoy-plugun). Versions prior to 1.13.2-envoy-2 construct input.parsed_path by treating HTTP request paths as full URIs and interpreting leading segments with ‘//’ as authorities, which drops those segments from the parsed path. This crea...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

opa-envoy-plugin 安全漏洞

opa-envoy-plugin is a plugin developed by Open Policy Agent. Versions of opa-envoy-plugin prior to 1.13.2-envoy-2 contained security vulnerabilities. These vulnerabilities stemmed from defects in the way the input.parsedpath field was constructed, which could lead to mismatches in path...

GHSA-9F29-V6MM-PW6W opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...