Skip to content
OpenAdvisories

Package · Go

github.com/open-policy-agent/opa

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.4
    CVE-2025-46569

    OPA server Data API HTTP path injection of Rego

    Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluatio…

    open-policy-agent opa github.com/open-policy-agent/opa github.com/open-policy-agent/opa/v1/server Go
  • High 7.4
    CVE-2022-36085

    OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions

    Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — …

    open-policy-agent opa github.com/open-policy-agent/opa Go
  • High 7.5
    CVE-2022-33082 Public exploit

    Denial of service in Open Policy Agent

    An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.

    github.com/open-policy-agent/opa Go
  • High 7.5
    CVE-2022-28946

    Out of bounds memory access in github.com/open-policy-agent/opa

    An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.

    github.com/open-policy-agent/opa Go