CyberSecBulletin

Openpolicyagent vulnerabilities

We track 2 vulnerabilities in Openpolicyagent products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 30, 2024.

2vulnerabilities
1critical
1high
0exploited
8.6average CVSS score

Latest Openpolicyagent vulnerabilities

  • 7.3 High severity

    OPA: Authentication Bypass by Capture-replay

    CVE-2024-8260Styra

    A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI

  • 9.8 Critical severity

    Open Policy Agent (OPA) is an open source, general-purpose policy engine.

    CVE-2022-36085Open-policy-agentEPSS 1.63%

    Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — b