Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody. - Affected versions: = 0.27.33 current HEAD...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: osv-scanner, eksctl, helm-set-status, opa-envoy, steampipe, grype, wolfictl, tw, k3s, kubescape, fuse-overlayfs-snapshotter, containerd, gogatekeeper, xeol, k8ssandra-client, syft, cluster-api-helm-controller, zarf, k9s, neuvector-scanner, skaffold, kargo, spegel,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: neuvector-fips, skaffold, zarf-fips, kaniko, kube-arangodb-fips, scorecard, eks-node-monitoring-agent, datadog-agent, containerd-fips, tigera-operator-fips, opa-fips, rancher, k8sgpt, trivy-fips, cluster-api-helm-controller-fips, consul-k8s, helm-operator,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, helm-set-status, hubble-ui, rclone, cosign, prometheus-pushgateway, terraform-provider-pagerduty, go-discover, dask-gateway, ingress-nginx-controller, kyverno-policy-reporter-kyverno-plugin, vault-secrets-webhook, kubescape,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: helm-set-status, cert-exporter, cosign, prometheus-pushgateway, terraform-provider-pagerduty, dask-gateway, redis-operator, atlantis, spqr, php-fpmexporter, pgtimetable, kubernetes-dashboard, wave, kuberlr, lazygit, kube-arangodb, esbuild, helm-mapkubeapis,...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GO-2026-4506 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsedpath in github.com/open-policy-agent/opa-envoy-plugin...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the "input.parsedpath" field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes "//" ...

CVE-2026-26205

CVE-2026-26205 affects the opa-envoy-plugin for Envoy (opa-envoy-plugun). Versions prior to 1.13.2-envoy-2 construct input.parsed_path by treating HTTP request paths as full URIs and interpreting leading segments with ‘//’ as authorities, which drops those segments from the parsed path. This crea...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

opa-envoy-plugin security vulnerabilities

opa-envoy-plugin is a plugin developed by Open Policy Agent. Versions of opa-envoy-plugin prior to 1.13.2-envoy-2 contained security vulnerabilities. These vulnerabilities stemmed from defects in the way the input.parsedpath field was constructed, which could lead to mismatches in path...