CVE-2026-26205 | open-policy-agent opa-envoy-plugin up to 1.13.2-envoy-1 HTTP Request input.parsed_path authorization (GHSA-9f29-v6mm-pw6w)

A vulnerability labeled as critical has been found in open-policy-agent opa-envoy-plugin up to 1.13.2-envoy-1. Affected is an unknown function of the component HTTP Request Handler. Executing a manipulation of the argument input.parsed_path can lead to incorrect authorization.

This vulnerability is tracked as CVE-2026-26205. The attack can be launched remotely. No exploit exists.

The affected component should be upgraded.