CVE-2022-23628: Incorrect Calculation in github.com/open-policy-agent/opa
Summary
CVE-2022-23628: Incorrect calculation in github.com/open-policy-agent/opa. Affects github.com/open-policy-agent/opa versions >= 0.33.1, < 0.37.2. Fixed in 0.37.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/open-policy-agent/opa is an open-source project that provides a policy engine for cloud-native environments. It allows users to define and enforce policies for access control, data filtering, and more. The vulnerability described in this report affects versions 0.33.1 to 0.37.1 of the package. The vulnerability arises from an incorrect calculation in the pretty-printing process of the Abstract Syntax Tree (AST) that can lead to a change in the logic of certain statements. This vulnerability can have an impact on policies that parse and compare web paths.
Vulnerability Detail
The vulnerability occurs when three specific conditions are met: 1) An AST of Rego is programmatically created with terms that lack a location, such as wildcard variables. 2) The AST is pretty-printed using the github.com/open-policy-agent/opa/format package. 3) The result of the pretty-printing is parsed and evaluated again using an OPA instance with bundles or Golang packages. If these conditions are met, the pretty-printing process can reorder array literals, potentially changing the logic of statements. An example provided demonstrates how a rule can be transformed, resulting in a different evaluation outcome. The severity of this vulnerability is considered moderate due to the specific conditions required for exploitation.
How To Fix
Latest published version: v1.21.3 as of 23 Oct 2026
go get github.com/open-policy-agent/opa@v1.21.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.37.2
This is the first release that contains the fix.
go get github.com/open-policy-agent/opa@v0.37.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to disable optimization when creating bundles. By disabling optimization, the conditions required for exploitation of the vulnerability are not met. This can be achieved by configuring the build process or the OPA instance to not apply optimization during bundle creation.
Conclusion
The vulnerability in github.com/open-policy-agent/opa has been addressed in version 0.37.2. Users are advised to update their package to the latest version to mitigate the risk of exploitation. Disabling optimization when creating bundles can serve as a temporary workaround. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/open-policy-agent/opa →
FAQ
Under specific conditions, the vulnerability can change the logic of certain statements by reordering array literals. This can lead to unexpected evaluation outcomes in policies that parse and compare web paths.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your application without requiring access to the code or installation.
Yes, the CVSS score for this vulnerability is 6.3, indicating a moderate severity level.
There are no known exploits for this vulnerability at the time of this report. However, it is recommended to update to the fixed version to mitigate any potential risks.
Disabling optimization when creating bundles can serve as a temporary mitigation for this vulnerability. However, it is still recommended to update to the fixed version to ensure comprehensive security.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/open-policy-agent/opa.
