Log in Start free

Vulnerability · Published Jul 15, 2024 · Assigned by GitHub_M

CVE-2024-40627OpaMiddleware does not filter HTTP OPTIONS requests

Medium 5.8

In plain English

A medium-severity security flaw in fastapi-opa from busykoala. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware` allows all HTTP `OPTIONS` requests without evaluating it against any policy. If an application provides different responses to HTTP `OPTIONS` requests based on an entity existing (such as to indicate whether an entity is writable on a system level), an unauthenticated attacker could discover which entities exist within an application. This issue has been addressed in release version 2.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIfastapi-opa2.0.1GHSA-5f5c-8rvc-j8wf
PyPIfastapi-opa2.0.1PYSEC-2026-1361
Ubuntu:22.04:LTSfastapino fix listedUBUNTU-CVE-2024-40627
Ubuntu:24.04:LTSfastapino fix listedUBUNTU-CVE-2024-40627
Ubuntu:25.10fastapino fix listedUBUNTU-CVE-2024-40627
Ubuntu:26.04:LTSfastapino fix listedUBUNTU-CVE-2024-40627
Ubuntu:26.10fastapino fix listedUBUNTU-CVE-2024-40627

Affected products (as reported)

VendorProductVersions
busykoala fastapi-opa < 2.0.1

Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References