v1.21.2
2026-10-13T08:52:13Z•0ecdc04c957c5a41063a9ea3d2baec471d20c1a6b3b9c6e6060a80d8c817bd02
CWE-89Compile APIData APIGo vulnerabilitiesHTTP handlerOPAOpen Policy AgentRegoSQL injectionauthorizationcompiler regressioncryptographydependency updateencoded slashgolang.org/x/netsecurity fix
What happened
Open Policy Agent releases v1.19.0–v1.21.2 include security-relevant fixes and dependency updates. OPA v1.19.0 fixes a SQL injection vector in the Compile API caused by unquoted caller-controlled SQL identifiers. v1.21.2 updates Go and golang.org/x/net for upstream security advisories and fixes inconsistent encoded-slash handling in authorization policy input and the Data API. v1.19.1 updates Go to address multiple standard-library vulnerabilities affecting HTTP and cryptographic functionality. Other releases address compiler, parser, and policy-evaluation regressions.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- open_policy_agent_opa_releases
- Record identifier
- 0ecdc04c957c5a41063a9ea3d2baec471d20c1a6b3b9c6e6060a80d8c817bd02
- Enrichment time
- 2026-10-13T08:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.