opa vulnerabilities

2 known vulnerabilities in opa from Open-policy-agent. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  opa: Improper Control of Generation of Code

  CVE-2025-46569May 1, 2025Open-policy-agent

  Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation

• 9.8 Critical severity

  Open Policy Agent (OPA) is an open source, general-purpose policy engine.

  CVE-2022-36085Sep 8, 2022Open-policy-agentEPSS 1.63%

  Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — b