CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: spegel, opa-envoy, containerd, headlamp, docker-cli-buildx, kube-arangodb, docker, kubescape-operator, manifest-tool, steampipe, chartmuseum, eksctl, helm-mapkubeapis, kaniko, helm-push, kots, consul-k8s, kubescape, helm-set-status, k8sgpt, grype, linkerd2, k9s,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: manifest-tool, spegel, trivy-operator-fips, linkerd2, amazon-ecs-agent-fips, kubescape, containerd-fips, kaniko-fips, chartmuseum, chartmuseum-fips, kgateway-fips, zarf-fips, cg, cluster-api-helm-controller-fips, xeol, helm-operator-fips, steampipe, rancher-agent,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, falco-no-driver, docker-cli-buildx, kube-arangodb, oras, mountpoint-s3-csi-driver, prometheus, speedtest-go, nri-mongodb, istio, lazygit, nats, vt-cli, vexctl, infinispan-operator, pulumi-language-yaml, terraform-docs, flux-helm-controller,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: falco-no-driver, opa-envoy, temporal, external-dns, cri-tools, falcoctl, docker-cli-buildx, descheduler, crossplane-provider-azure-storage, dkron, kube-arangodb, amazon-cloudwatch-agent-operator, dex, kserve-modelmesh-serving, cloud-provider-vsphere, prometheus,...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy, opa-fips-envoy...

CVE-2026-26205 vulnerabilities

Vulnerabilities for packages: opa-envoy, opa-fips-envoy...

GO-2026-4506 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsedpath in github.com/open-policy-agent/opa-envoy-plugin...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

CVE-2026-26205 affects the opa-envoy-plugin for Envoy (opa-envoy-plugun). Versions prior to 1.13.2-envoy-2 construct input.parsed_path by treating HTTP request paths as full URIs and interpreting leading segments with ‘//’ as authorities, which drops those segments from the parsed path. This crea...

CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

opa-envoy-plugin 安全漏洞

opa-envoy-plugin is a plugin developed by Open Policy Agent. Versions of opa-envoy-plugin prior to 1.13.2-envoy-2 contained security vulnerabilities. These vulnerabilities stemmed from defects in the way the input.parsedpath field was constructed, which could lead to mismatches in path...

GHSA-9F29-V6MM-PW6W opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

A security vulnerability has been discovered in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as authority components, and therefore dropping them from the parsed path. Thi...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, falco-no-driver, vcluster, glab, docker-cli-buildx, kube-arangodb, oras, prometheus-alertmanager, mountpoint-s3-csi-driver, prometheus, speedtest-go, nri-mongodb, terraform-provider-acme, cloudprober, istio, nats, vt-cli, infinispan-operator,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: spegel, opa-envoy, docker-cli-buildx, docker, chartmuseum, eksctl, kots, kaniko, helm-push, kubescape, k8sgpt, nerdctl, cert-manager-cmctl, grype, linkerd2, dagger, k3s, ctop, neuvector-scanner, rancher-fleet, wolfictl, osv-scanner, fuse-overlayfs-snapshotter, xeol,...