Open-policy-agent vulnerabilities
We track 3 vulnerabilities in Open-policy-agent products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on February 19, 2026.
Latest Open-policy-agent vulnerabilities
- 7.1 High severity
opa-envoy-plugin: Incorrect Authorization
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segme
- 7.4 High severity
opa: Improper Control of Generation of Code
Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation
- 9.8 Critical severity
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — b