CVE-2024-8260: OPA for Windows SMB Force-Authentication Vulnerability
Summary
CVE-2024-8260: OPA for Windows has an SMB force-authentication vulnerability. Affects github.com/open-policy-agent/opa versions < 0.68.0. Fixed in 0.68.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open Policy Agent (OPA) is an open-source policy engine that enables unified authorization across various services. It allows users to define policies using a high-level declarative language called Rego. OPA is widely used in cloud-native environments to enforce policies for microservices, Kubernetes, and more. However, a vulnerability has been identified in OPA for Windows, specifically affecting versions prior to v0.68.0, which could lead to unauthorized access through improper input validation.
Vulnerability Detail
The SMB force-authentication vulnerability in OPA for Windows arises from inadequate input validation. This flaw allows an attacker to pass an arbitrary SMB share instead of a Rego file as an argument to the OPA CLI or to functions within the OPA Go library. As a result, this could lead to unauthorized access to sensitive data or resources, potentially compromising the security of the system. The vulnerability is classified under CWE-294, which pertains to the violation of the principle of least privilege.
How To Fix
Latest published version: v1.21.3 as of 23 Oct 2026
go get github.com/open-policy-agent/opa@v1.21.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.68.0
This is the first release that contains the fix.
go get github.com/open-policy-agent/opa@v0.68.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the OPA CLI and its functions by implementing strict access controls and ensuring that only authorized users can execute commands that interact with SMB shares. Additionally, validate inputs to ensure that only legitimate Rego files are processed.
Conclusion
The SMB force-authentication vulnerability in OPA for Windows poses a significant risk to users of versions prior to v0.68.0. It is crucial for users to upgrade to the latest version to mitigate this risk. Implementing access controls and validating inputs can serve as temporary measures until the upgrade is completed.
See every vulnerability recorded for github.com/open-policy-agent/opa →
FAQ
The vulnerability allows unauthorized users to access sensitive data by passing arbitrary SMB shares instead of valid Rego files, potentially leading to data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
All versions of OPA for Windows prior to v0.68.0 are affected by this vulnerability.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Gopkg.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/open-policy-agent/opa.
