CVE-2026-26205: open-policy-agent opa-envoy-plugin Incorrect Authorization

Vulnerability summary

CVE-2026-26205 is a high (CVSS 7.1) Incorrect Authorization vulnerability in open-policy-agent opa-envoy-plugin. EPSS estimates a 0.96% chance of exploitation in the next 30 days, higher than 60.8% of scored vulnerabilities.

Timeline

1. 19-02-2026
   PublishedVulnerability first disclosed.
2. 19-02-2026
   Last modifiedVulnerability information updated.

Description

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass access controls by crafting requests where the authorization filter evaluates a different path than the one ultimately served. Version 1.13.2-envoy-2 fixes the issue.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.