v1.22.0
2026-11-04T08:52:12Z•02c01bf54024c2e07ab77b6d58b2ffe950512a5794320e12c709447df2849823
OPAOpen Policy AgentRegoauthentication bypassbundle signature verificationpolicy integritysecurity updatesupply-chain security
What happened
Open Policy Agent releases v1.21.3 and later address a security issue where bundle signature verification could be bypassed, allowing attackers who can modify bundle bytes or control the bundle delivery path to supply arbitrary policy and data. The fix ensures verification is required whenever a signing block is configured, rather than only when signing.keyid is present. Later releases also include dependency updates and functional bug fixes.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- open_policy_agent_opa_releases
- Record identifier
- 02c01bf54024c2e07ab77b6d58b2ffe950512a5794320e12c709447df2849823
- Enrichment time
- 2026-11-04T08:52:12Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.