Skip to content

open-policy-agent

Products

Product	CVEs	Exploited	Latest
opa	3	–	May 1, 2025
opa-envoy-plugin	1	–	Feb 19, 2026

Exploited and recent CVEs

CVE-2026-26205 High 7.1 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path` 0.5%
CVE-2025-46569 High 7.4 OPA server Data API HTTP path injection of Rego 0.5%
CVE-2022-36085 High 7.4 OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions 1.6%
CVE-2022-23628 Medium 6.3 Array literal misordering in github.com/open-policy-agent/opa 1.0%