CVE-2026-26205: 
Wolfi vulnerability analysis and mitigation

CVE-2026-26205 is an authorization bypass vulnerability in the opa-envoy-plugin (Open Policy Agent's Envoy integration) caused by double-slash path misinterpretation in the input.parsed_path field. It affects all versions up to and including v1.13.1-envoy (Go module) and Docker images openpolicyagent/opa:*-envoy up to 1.13.1-envoy and 1.13.1-envoy-static. The vulnerability was published on February 18, 2026, with a patch released the same day. It carries a CVSS v4 base score of 7.1 (High) (GitHub Advisory).

The root cause (CWE-863: Incorrect Authorization) lies in the getParsedPathAndQuery function in envoyauth/request.go, which used Go's url.Parse() to process HTTP request-target paths. Per RFC 3986, url.Parse() interprets a path beginning with // as containing an authority component, causing the leading path segment (e.g., //admin) to be silently dropped from input.parsed_path. This creates a mismatch: the OPA policy evaluates a truncated path (e.g., ["users"]) while the backend server receives and normalizes the full path (e.g., /admin/users). The fix replaces url.Parse() with manual string splitting using strings.Cut and url.PathUnescape, correctly preserving double-slash prefixes in the parsed path (GitHub Advisory, Fix Commit). Exploitation requires no privileges or user interaction, but does require that the deployment uses input.parsed_path for path-based authorization decisions and that the backend server applies lenient path normalization.

Successful exploitation allows an unauthenticated remote attacker to bypass OPA-enforced access controls and reach protected backend resources (e.g., administrative endpoints) that should be restricted. The vulnerable system itself has no direct confidentiality, integrity, or availability impact, but the subsequent (backend) systems are exposed to high confidentiality, integrity, and availability risks, as the authorization layer is effectively circumvented. This could enable unauthorized data access, modification of sensitive resources, or disruption of services protected by the OPA-Envoy policy layer (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.082–0.134%, placing it in the 33rd percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. Exploitation is straightforward for any attacker who can send HTTP requests to a service protected by a vulnerable opa-envoy-plugin deployment, requiring only knowledge of the double-slash path technique.

1. Reconnaissance: Identify services protected by opa-envoy-plugin versions ≤ 1.13.1-envoy, particularly those with path-hierarchical authorization policies using input.parsed_path (e.g., policies that restrict /admin/* paths).
2. Craft malicious request: Construct an HTTP request with a double-slash prefix on the protected path segment, such as GET //admin/users HTTP/1.1 with Host: example.com.
3. Send request: Transmit the crafted request to the Envoy proxy fronting the target service. The OPA authorization filter evaluates input.parsed_path as ["users"] (the //admin authority component is dropped), which does not match the protected /admin/* policy rule — so the request is permitted.
4. Backend access: The backend server receives the path //admin/users, normalizes it to /admin/users, and serves the protected resource, effectively bypassing the authorization control (GitHub Advisory, Security Advisory).

• Network: HTTP requests to backend services with paths beginning with // (double-slash), such as GET //admin/... or GET //api/..., visible in Envoy access logs or upstream proxy logs.
• Logs: Envoy access logs showing requests with double-slash path prefixes that received 200 OK or other success responses from protected endpoints; OPA decision logs showing input.parsed_path values that do not include expected leading path segments (e.g., ["users"] for a request to //admin/users).
• Application Logs: Unexpected access to administrative or restricted API endpoints (e.g., /admin/users, /admin/dashboard) from unauthenticated or low-privilege sources, without corresponding OPA deny decisions.

The primary remediation is to upgrade opa-envoy-plugin to v1.13.2-envoy-2 (Go) or Docker images 1.13.2-envoy-2 / 1.13.2-envoy-2-static (Release Notes). For deployments that cannot immediately upgrade, two workarounds are available: (1) Enable the merge_slashes option in Envoy configuration, which collapses redundant slashes in request paths before they reach the OPA filter; (2) Update OPA policies to use input.attributes.request.http.path (the raw, unprocessed path) instead of input.parsed_path, implementing custom path splitting logic as shown in the advisory (GitHub Advisory, Security Advisory).

The vulnerability was discovered and reported by researcher thevilledev, who also authored the fix. The advisory was published by johanfylling (Open Policy Agent maintainer) on February 18, 2026. Red Hat acknowledged the vulnerability on February 20, 2026 (Red Hat CVE). No significant broader media coverage or social media discussion has been identified beyond standard vulnerability database aggregation.