VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/open-policy-agent/opa: vulnerability history, versions and safety

github.com/open-policy-agent/opa is a package in the Go ecosystem. Vulert records 14 vulnerabilities for it across 120 releases, from Feb 2022 to May 2025. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
14 vulnerabilities recorded H3 M2 U9
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/open-policy-agent/opa vulnerabilities

Vulert verdict on github.com/open-policy-agent/opa v1.21.3 i

Updated on 23 Oct 2026

Action needed: v1.21.3 has 9 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 88/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.21.3 — affected i
  • Vulnerabilities on record 14 over 3 years · 0 in the last year i
  • Latest disclosure 05 May 2025 i
  • Highest CVSS 7.5 i
  • With no published fix 0 i
  • Stars 12,388 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/open-policy-agent/opa, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022173018-01eefbab7949 22 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261022140034-7e94957afdd8 22 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261021131229-9981dd1a8869 21 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261020192651-cbc1b4352eee 20 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261020183638-9d0c627c9c71 20 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261020171316-689a4e83a503 20 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261020164334-be57bb5bcac5 20 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261020161144-456d8661203f 20 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261020140817-3a25f9ad0ed5 20 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261020090113-04c023cbbf6e 20 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v1.21.3 19 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261019194746-1c3090029733 19 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261019155423-45eb1b5009a3 19 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261016180117-7bcf86187363 16 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261016173144-93a020f8251b 16 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261015211549-fdf6011f57fd 15 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261015070251-099e8cd0eaaf 15 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261014203042-89d111ce4b45 14 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261014174547-25956d3bd950 14 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261014091510-87b019fda6b3 14 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261014071221-c9c7aac70290 14 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261014062556-384dfa3f7455 14 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261013154559-5a1e6a8bd58f 13 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261013072739-d769d36c8c09 13 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261013071120-36408cfcdebf 13 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v1.21.2 12 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261012124916-89ed3cf26b7b 12 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261009143017-b86655f93c69 09 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261009123404-402c9e46ef24 09 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261008211547-4dcda5da919a 08 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261008170645-8451d8cd78d0 08 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261007211408-e5cd7da7a905 07 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261007184633-aa16f61b314f 07 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261007173552-3901da6ecb81 07 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261007160054-26ae7cead05e 07 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261007135717-5af35bc59035 07 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261007100543-02d819d2d460 07 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261006154147-b5c3e0809866 06 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261005130229-d179cdae4073 05 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261005060659-c9b1edc35749 05 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261002183003-3f2d1bd96090 02 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261002124341-efb03141f098 02 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261001225141-f24bf895c799 01 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261001174622-d566972d31c8 01 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20261001115206-1a48da90d20d 01 Oct 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260930165008-5eb559bd0b83 30 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260930130954-1e2c023d5071 30 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260930105835-753cf54117b7 30 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260929191043-2a109e541033 29 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v1.21.1 29 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260929190406-f9bfcf35bb9f 29 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260929151844-41b66a84a87a 29 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260929133500-e61b00369dfa 29 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260929131007-37ef8a3448b3 29 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260929122307-98780d0fc4b8 29 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260928185453-bd9e302ab919 28 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260928155137-acf121d835f1 28 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260928071314-3d0fbc5d7f64 28 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260925145142-a6c13a96f0cd 25 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260925081505-fb4fe65b5364 25 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260925071753-ac6604d16e37 25 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260924204907-431f40430e30 24 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260924152814-1342a6c65e14 24 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260924131111-dc6269f2c648 24 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v1.21.0 24 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260924124437-f6aa85fb34c6 24 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260924085714-b7a4a421e9da 24 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260923213215-2dcd8ab9eaca 23 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260923182029-c327a1472495 23 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260923152145-a83674f1bf26 23 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260923113349-455aebdf7dee 23 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260922124338-783cfb3a1f41 22 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260921152147-733bdf9b7ab7 21 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260921142556-237455042e28 21 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260921062117-8cb390243358 21 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260918182401-ae4ed955ad73 18 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260918143038-09397a342157 18 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260918101411-795adea171c2 18 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260918093147-8f78370ba7d0 18 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260918075033-fa9bb233f8f5 18 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260918065412-0a1081b4d3a5 18 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260917153337-8d744eaa9459 17 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260917125103-5f1d7e89eace 17 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260917114648-ac85865970cf 17 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260917063549-f59697fcb5ef 17 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260916190231-30ba100d3f6d 16 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260915172048-8e9c5a43ca4c 15 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260915135905-bdcfe8f4da10 15 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260915131125-310a38ce72e8 15 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260915093947-fb7004d8cb30 15 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260914162333-3bb5178a4964 14 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260914113834-c9acbf66d242 14 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260911203253-961849b565d2 11 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260911150355-effb7c3f9d46 11 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260910173409-8ce961d78fc6 10 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260910065443-4890cddcafb3 10 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260909192051-c80cd79db77a 09 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260909170048-65bb4b26ea0f 09 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260909160747-f24d0c2573ed 09 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260909103739-152afb102c0c 09 Sep 2026 H2 M1 U6 Apache-2.0 Yes Details →
v0.0.0-20260909094817-583f704b9592 09 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260909091013-1249eb560b77 09 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260908233700-b54bba6d44ab 08 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260908164458-ddb7546e8ada 08 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260908131546-035a21429373 08 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260908085004-9d3694a4335a 08 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260907102339-f2246f414a90 07 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260904152200-855776c6b19d 04 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260904072455-7dcb316def52 04 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260903210108-1cd7ec6f620e 03 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260903203514-b2c26708e9d5 03 Sep 2026 H2 M1 U6 — Yes Details →
v1.20.2 03 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260903163456-898504cd6fe7 03 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260903142225-bc46211b4432 03 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260903094356-92da7b47f054 03 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260902231426-25a1d928d6ff 02 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260902122832-5bf959fb63a5 02 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260902085600-fa8d78f1e4ef 02 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260902061640-0c3ade43ccb6 02 Sep 2026 H2 M1 U6 — Yes Details →
v0.0.0-20260901194453-88c2ee0cdc90 01 Sep 2026 H2 M1 U6 — Yes Details →

The newest 120 of 4,382 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 11
  • 2024 2
  • 2025 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 14 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/open-policy-agent/opa

The 5 most severe of 14 vulnerabilities recorded for this package

Search all 14 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2022-33082: Denial of Service in Open Policy Agent 7.5 high 0.42.0 01 Jul 2022
CVE-2022-28946: Out of Bounds Memory Access in github.com/open-policy-agent/opa 7.5 high 0.40.0 20 May 2022
CVE-2022-36085: Open Policy Agent (OPA) Compiler Bypass of WithUnsafeBuiltins 7.4 high 0.43.1 16 Sep 2022
CVE-2022-23628: Incorrect Calculation in github.com/open-policy-agent/opa 6.3 medium 0.37.2 09 Feb 2022
CVE-2024-8260: OPA for Windows SMB Force-Authentication Vulnerability 6.1 medium 0.68.0 30 Aug 2024

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/open-policy-agent/opa

Is github.com/open-policy-agent/opa safe to use?

Vulert records 14 vulnerabilities for github.com/open-policy-agent/opa in Go: 0 critical, 3 high, 2 medium and 0 low, plus 9 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/open-policy-agent/opa's Vulert package health score?

Vulert scores github.com/open-policy-agent/opa 88/100, which reads as healthy. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/open-policy-agent/opa affected?

Yes. v1.21.3, the version you would install today, has 9 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does github.com/open-policy-agent/opa have?

14 vulnerabilities are recorded for github.com/open-policy-agent/opa in the Go ecosystem: 0 critical, 3 high, 2 medium and 0 low, plus 9 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/open-policy-agent/opa vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/open-policy-agent/opa in the last 12 months, and the oldest entry in this database dates to 09 Feb 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/open-policy-agent/opa are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/open-policy-agent/opa for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/open-policy-agent/opa version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.