Skip to content
OpenAdvisories

Vendor

open-policy-agent

4 known vulnerabilities.

Products

opa 3 opa-envoy-plugin 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-26205

    opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`

    opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segm…

    open-policy-agent opa-envoy-plugin opa-envoy github.com/open-policy-agent/opa-envoy-plugin Wolfi Go
  • High 7.4
    CVE-2025-46569

    OPA server Data API HTTP path injection of Rego

    Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluatio…

    open-policy-agent opa kots trivy Azure Linux Wolfi Go
  • High 7.4
    CVE-2022-36085

    OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions

    Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — …

    open-policy-agent opa github.com/open-policy-agent/opa Go