TI-2022-16508 CVE-2022-36085 · GHSA-f524-rf33-2jjr
OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions
Priority HIGH 76
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
open-policy-agent
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
open-policy-agent records in CISA KEVNo open-policy-agent vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2022-07681 CVE-2022-23628 · GHSA-hcw3-j74m-qc58
Array literal misordering in github.com/open-policy-agent/opa
Priority MEDIUM 61
OPA is an open source, general-purpose policy engine.
TI-2022-14552 CVE-2022-33082 · GHSA-2m4x-4q9j-w97g
An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers…
Priority LOW 36
An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.
TI-2025-29282 CVE-2025-46569 · GHSA-6m8w-jc87-6cr7
OPA server Data API HTTP path injection of Rego
Priority LOW 35
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
TI-2022-11544 CVE-2022-28946 · GHSA-x7f3-62pm-9p38
An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the…
Priority LOW 35
An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.
TI-2026-21196 CVE-2026-26205 · GHSA-9f29-v6mm-pw6w
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`
Priority LOW 32
opa-envoy-plugun is a plugin to enforce OPA policies with Envoy.
TI-2024-07657 CVE-2024-8260 · GHSA-c77r-fh37-x2px
OPA SMB Force-Authentication
Priority LOW 32
A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0.
TI-2021-19735 CVE-2021-43979 · GHSA-v8hv-78vf-x9fr
Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes…
Priority LOW 26
Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control.