CVE-2026-26205 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

What is CVE-2026-26205?

CVE-2026-26205 is a high-severity authentication bypass vulnerability in open-policy-agent opa-envoy-plugin, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.

Weakness: CWE-863

Which versions are affected by CVE-2026-26205?

3 open source packages ship an affected version, including github.com/open-policy-agent/opa-envoy-plugin.

How do I fix CVE-2026-26205?

Upgrade github.com/open-policy-agent/opa-envoy-plugin to 1.13.2-envoy-2 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-26205 being exploited?

There is no known exploitation of CVE-2026-26205 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9f29-v6mm-pw6w, GO-2026-4506.