OPA SMB Force-Authentication
Priority LOW 32CWE-294Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-294.
Summary
A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix Partial OPA (Styra): v0.68.0github.com/open-policy-agent/opa (Go): 0.68.0Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Styra | OPA | before v0.68.0 | v0.68.0 | Patch available | CNA |
| — | github.com/open-policy-agent/opa (Go) | before 0.68.0 | 0.68.0 | Patch available | GHSA-c77r-fh37-x2px |
- OPA VendorStyra Affected before v0.68.0 Fixed in v0.68.0 Patch available CNA
- github.com/open-policy-agent/opa (Go) Vendor— Affected before 0.68.0 Fixed in 0.68.0 Patch available GHSA-c77r-fh37-x2px
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openpolicyagent:open_policy_agent:*:*:*:*:*:*:*:* | before 0.68.0 | Vulnerable | open-policy-agent |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:openpolicyagent:open_policy_agent:*:*:*:*:*:*:*:* Versions before 0.68.0 Vulnerable ·open-policy-agent
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA OPA (Styra) Fixed in v0.68.0
- Fix · GHSA-c77r-fh37-x2px github.com/open-policy-agent/opa (Go) Fixed in 0.68.0 Advisory →
Red Hat 1 advisory
- RHSA-2024:10948 Released 2024-12-11 · Red Hat rating ModerateRed Hat OpenShift distributed tracing platform (Tempo) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3.4 | Fixed | RHSA-2024:10948 |
Not affected: 3 products
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Virtualization
- Red Hat OpenShift distributed tracing 3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8260
- 2026-10-03 Alias added: GHSA-c77r-fh37-x2px
References
Advisory 2
More open-policy-agent Open Policy Agent vulnerabilities
- TI-2022-16508 OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions CVSS 3.1CRITICAL 9.8
- TI-2022-07681 Array literal misordering in github.com/open-policy-agent/opa CVSS 3.1MEDIUM 6.3
- TI-2022-14552 An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers… CVSS 3.1HIGH 7.5
- TI-2022-11544 An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the… CVSS 3.1HIGH 7.5
Sources
- CVE-2024-8260 · CVE Program
- CVE-2024-8260 · NVD
- FIRST EPSS
- GHSA-c77r-fh37-x2px · GitHub Advisory Database · CC BY 4.0
- CVE-2024-8260 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences