PT-2026-20568 · Envoy · Opa-Envoy-Plugin
Thevilledev
·
Published
2026-02-18
·
Updated
2026-03-03
·
CVE-2026-26205
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
opa-envoy-plugun versions prior to 1.13.2-envoy-2
Description
The
opa-envoy-plugun plugin has an issue in how the input.parsed path field is constructed. HTTP request paths are treated as full URIs during parsing, leading to the interpretation of leading path segments prefixed with double slashes (//) as authority components, and subsequently dropping them from the parsed path. This discrepancy between the path evaluated by the authorization filter and the path served by the backend server can allow attackers to bypass access controls by crafting malicious requests. The issue arises when authorization policies rely on input.parsed path for path-based decisions, and backend servers apply lenient path normalization. The affected request pattern examples demonstrate how the input.parsed path field can differ from the actual request path, potentially leading to unauthorized access. The input.attributes.request.http.path field contains the unprocessed, raw request path.Recommendations
Versions prior to 1.13.2-envoy-2: Upgrade to version 1.13.2-envoy-2 or later.
Versions prior to 1.13.2-envoy-2: Enable the
merge slashes Envoy configuration option.
Versions prior to 1.13.2-envoy-2: Use input.attributes.request.http.path instead of input.parsed path in policies.Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Opa-Envoy-Plugin