open-policy-agent vulnerabilities

4 published CVEs name open-policy-agent among the affected products.

Critical 0High 3Medium 1Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-26205
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`
open-policy-agent · opa-envoy-plugin
High7.1
CVE-2025-46569
OPA server Data API HTTP path injection of Rego
open-policy-agent · opa
High7.4
CVE-2022-36085
OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions
open-policy-agent · opa
High7.4
CVE-2022-23628
Array literal misordering in github.com/open-policy-agent/opa
open-policy-agent · opa
Medium6.3