github.com/open-policy-agent/opa

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

View on Go

View on Github

Activity

Latest release: 15h ago
Total releases: 77
Cadence: ~12 days
Last 12 months: 31

Reach

Stars: 12.4k

Details

First release: Nov 07, 2016

Releases

Version	Released
`v1.22.0` minor	Oct 29, 2026
`v1.21.4` patch	Oct 23, 2026
`v1.21.3` patch	Oct 19, 2026
`v1.21.2` patch	Oct 12, 2026
`v1.21.1` patch	Sep 29, 2026
`v1.21.0` minor	Sep 24, 2026
`v1.20.2` patch	Sep 03, 2026
`v1.20.1` patch	Aug 28, 2026
`v1.20.0` minor	Aug 27, 2026
`v1.19.1` patch	Aug 17, 2026
`v1.19.0` minor	Jul 30, 2026
`v1.18.2` patch	Jul 02, 2026
`v1.18.1` patch	Jun 29, 2026
`v1.18.0` minor	Jun 25, 2026
`v1.17.1` patch	Jun 08, 2026
`v1.17.0` minor	May 28, 2026
`v1.16.2` patch	May 12, 2026
`v1.16.1` patch	May 01, 2026
`v1.16.0` minor	Apr 30, 2026
`v1.15.2` patch	Apr 08, 2026
`v1.15.1` patch	Mar 30, 2026
`v1.15.0` minor	Mar 26, 2026
`v1.14.1` patch	Mar 09, 2026
`v1.14.0` minor	Feb 26, 2026
`v1.13.2` patch	Feb 18, 2026
`v1.13.1` patch	Jan 29, 2026
`v1.13.0` minor	Jan 29, 2026
`v1.12.3` patch	Jan 14, 2026
`v1.12.2` patch	Jan 06, 2026
`v1.12.1` minor	Dec 18, 2025
`v1.11.1` minor	Dec 16, 2025
`v1.1.0` minor 1 CVE	Jan 27, 2025
`v1.0.1` major 1 CVE	Jan 21, 2025
`v0.67.1` minor 2 CVEs	Aug 05, 2024
`v0.63.0` minor 2 CVEs	Mar 28, 2024
`v0.61.0` minor 2 CVEs	Jan 25, 2024
`v0.59.0` minor 2 CVEs	Nov 30, 2023
`v0.58.0` minor 2 CVEs	Oct 26, 2023
`v0.54.0` minor 2 CVEs	Jun 29, 2023
`v0.53.1` minor 2 CVEs	Jun 06, 2023
`v0.51.0` minor 2 CVEs	Mar 31, 2023
`v0.50.2` minor 2 CVEs	Mar 21, 2023
`v0.49.1` minor 2 CVEs	Feb 21, 2023
`v0.47.4` patch 2 CVEs	Dec 21, 2022
`v0.47.2` patch 2 CVEs	Dec 09, 2022
`v0.47.1` minor 2 CVEs	Dec 07, 2022
`v0.46.1` patch 2 CVEs	Nov 03, 2022
`v0.46.0` minor 2 CVEs	Nov 03, 2022
`v0.39.0` minor 4 CVEs	Mar 31, 2022
`v0.38.0` minor 4 CVEs	Mar 03, 2022

1–50 of 77

Repository

open-policy-agent/opa

Forks: 1.7k
Open issues: 265
Language: Go
: 8.0/ 10

opa
policy
declarative
json
compliance
cloud-native

Dependencies (52)

Depends on

v1.22.0

Used by

1192

Supply-chain exposure

1,192 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (6)

CVE-2025-46569 GO-2025-3660 GHSA-6m8w-jc87-6cr7 May 05, 2025

OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa

OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa

Fixed in

1.4.0

References

https://github.com/open-policy-agent/opa/security/advisories/GHSA-6m8w-jc87-6cr7
https://github.com/open-policy-agent/opa/commit/ad2063247a14711882f18c387a511fc8094aa79c

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-8260 GO-2024-3141 GHSA-c77r-fh37-x2px Sep 20, 2024

OPA for Windows has an SMB force-authentication vulnerability in github.com/open-policy-agent/opa

OPA for Windows has an SMB force-authentication vulnerability. Due to improper input validation, it allows a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

Fixed in

0.68.0

References

https://github.com/open-policy-agent/opa/commit/10f4d553e6bb6ae9c69611ecdd9a77dda857070e
https://www.tenable.com/security/research/tra-2024-36

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-36085 GHSA-f524-rf33-2jjr GO-2022-0978 Sep 16, 2022

OPA Compiler: Bypass of WithUnsafeBuiltins using "with" keyword to mock functions

7.4 / 10
High
Network High None None Unchanged High High None

Impact

The Rego compiler provides a (deprecated) WithUnsafeBuiltins function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the with keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by WithUnsafeBuiltins.

The same method is exposed via rego.UnsafeBuiltins in the github.com/open-policy-agent/opa/rego package.

When provided e.g. the http.send built-in function to WithUnsafeBuiltins, the following policy would still compile, and call the http.send function with the arguments provided to the is_object function when evaluated:

package policy foo := is_object({ "method": "get", "url": "https://www.openpolicyagent.org" }) allow := r { r := foo with is_object as http.send }

Both built-in functions and user provided (i.e. custom) functions are mockable using this construct.

In addition to http.send, the opa.runtime built-in function is commonly considered unsafe in integrations where policy provided by untrusted parties is evaluated, as it risks exposing configuration, or environment variables, potentially carrying sensitive information.

Affected Users

All of these conditions have to be met to create an adverse effect:

Use the Go API for policy evaluation (not the OPA server, or the Go SDK)

Make use of the WithUnsafeBuiltins method in order to deny certain built-in functions, like e.g. http.send, from being used in policy evaluation.

Allow policy evaluation of policies provided by untrusted parties.

The policies evaluated include the with keyword to rewrite/mock a built-in, or custom, function to that of another built-in function, such as http.send.

Additionally, the OPA Query API is affected:

If the OPA Query API is exposed to the public, and it is relied on http.send to be unavailable in that context. Exposing the OPA API to the public without proper authentication and authorization in place is generally advised against.

Patches

v0.43.1, v0.44.0

Workarounds

The WithUnsafeBuiltins function has been considered deprecated since the introduction of the capabilities feature in OPA v0.23.0 . While the function was commented as deprecated, the format of the comment was however not following the convention for deprecated functions, and might not have been picked up by tooling like editors. This has now been fixed. Users are still encouraged to use the capabilities feature over the deprecated WithUnsafeBuiltins function.

If you cannot upgrade, consider using capabilities instead:

Code like this using the github.com/open-policy-agent/opa/ast package:

// VULNERABLE with OPA <= 0.43.0 unsafeBuiltins := map[string]struct{}{ ast.HTTPSend.Name: struct{}{}, } compiler := ast.NewCompiler().WithUnsafeBuiltins(unsafeBuiltins)

needs to be changed to this:

caps := ast.CapabilitiesForThisVersion() var j int for i, bi := range caps.Builtins { if bi.Name == ast.HTTPSend.Name { j = i break } } caps.Builtins[j] = caps.Builtins[len(caps.Builtins)-1] // put last element into position j caps.Builtins = caps.Builtins[:len(caps.Builtins)-1] // truncate slice compiler := ast.NewCompiler().WithCapabilities(caps)

When using the github.com/open-policy-agent/opa/rego package:

// VULNERABLE with OPA <= 0.43.0 r := rego.New( // other options omitted rego.UnsafeBuiltins(map[string]struct{}{ast.HTTPSend.Name: struct{}{}}), )

needs to be changed to

r := rego.New( // other options omitted rego.Capabilities(caps), )

with caps defined above.

Note that in the process, some error messages will change: http.send in this example will no longer be "unsafe" and thus forbidden, but it will simply become an "unknown function".

References

Fix commit on main: https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823

Fix commit in 0.43.1 release: https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8, release page for 0.43.1: https://github.com/open-policy-agent/opa/releases/tag/v0.43.1

Function mocking feature introduced in https://github.com/open-policy-agent/opa/pull/4540 and https://github.com/open-policy-agent/opa/pull/4616

Documentation on the capabilities feature, which is the preferred way of providing a list of allowed built-in functions. The capabilities feature is not affected by this vulnerability.

For more information

If you have any questions or comments about this advisory:

Open an issue in Community Discussions

Ask in Slack: https://slack.openpolicyagent.org/

Fixed in

0.43.1

References

https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr
https://nvd.nist.gov/vuln/detail/CVE-2022-36085
https://github.com/open-policy-agent/opa/pull/4540
https://github.com/open-policy-agent/opa/pull/4616
https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823
https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8

Updated Jan 23, 2024 · Source: OSV.dev
CVE-2022-23628 GO-2022-0316 GHSA-hcw3-j74m-qc58 Jul 27, 2022

Incorrect calculation in github.com/open-policy-agent/opa

Pretty-printing an AST that contains synthetic nodes can change the logic of some statements by reordering array literals.

Fixed in

0.37.2

References

https://github.com/open-policy-agent/opa/security/advisories/GHSA-hcw3-j74m-qc58
https://github.com/open-policy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239
https://github.com/open-policy-agent/opa/commit/2bd8edab9e10e2dc9cf76ae8335ced0c224f3055

Updated May 20, 2024 · Source: OSV.dev
CVE-2022-33082 GO-2022-0574 GHSA-2m4x-4q9j-w97g Jul 01, 2022

Denial of service in github.com/open-policy-agent/opa

An issue in the AST parser of Open Policy Agent makes it possible for attackers to cause a Denial of Service attack from a crafted input.

Fixed in

0.42.0

References

https://github.com/open-policy-agent/opa/pull/4701
https://github.com/open-policy-agent/opa/commit/064f6168a8dfebdeb2ea147f7882bb9f5d2b7f67
https://github.com/open-policy-agent/opa/issues/4762

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-28946 GO-2022-0587 GHSA-x7f3-62pm-9p38 May 20, 2022

Out of bounds memory access in github.com/open-policy-agent/opa

An issue in ast.Parser in Open Policy Agent causes the application to incorrectly interpret expressions, allowing a Denial of Service (DoS) via triggering out-of-range memory access.

Fixed in

0.40.0

References

https://github.com/open-policy-agent/opa/pull/4548
https://github.com/open-policy-agent/opa/commit/e9d3828db670cbe11129885f37f08cbf04935264

Updated Feb 04, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 1
minor 41
patch 30
pre 4

77 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More