Incorrect Authorization Affecting github.com/open-policy-agent/opa/v1/server package, versions <1.4.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Incorrect Authorization vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMOPENPOLICYAGENTOPAV1SERVER-9919789
- published2 May 2025
- disclosed1 May 2025
- creditGamray, HyouKa'sh
Introduced: 1 May 2025
NewCVE-2025-46569 Â (opens in a new tab)How to fix?
Upgrade github.com/open-policy-agent/opa/v1/server to version 1.4.0 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Authorization via the HTTP Data API. An attacker can manipulate the Rego code within the query to either cause the server to perform unintended actions or to consume excessive resources, leading to a Denial of Service (DoS).
Note:
This is only exploitable if all of these conditions are met:
OPA is deployed as a standalone server (rather than being used as a Go library);
Network access to OPA's RESTful APIs is not restricted to
localhostor trusted networks.The configured authorization policy does not do exact matching of the
input.pathattribute when deciding if the request should be allowed.