open-policy-agent opa up to 1.3.x authorization

Summaryinfo

A vulnerability has been found in open-policy-agent opa up to 1.3.x and classified as very critical. The impacted element is an unknown function. Performing a manipulation results in authorization. This vulnerability is cataloged as CVE-2025-46569. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in open-policy-agent opa up to 1.3.x. It has been classified as very critical. This affects an unknown part. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA’s RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-46569 since 04/24/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/02/2025).

The vulnerability scanner Nessus provides a plugin with the ID 243299 (SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2025:02592-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.4.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (243299). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• open-policy-agent

Name

• opa

Version

• 1.0
• 1.1
• 1.2
• 1.3

Website

• Product: https://github.com/open-policy-agent/opa/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion