v1.22.0
2026-10-30T08:52:13Z•15dbff9ef974ec0d865e90f769687c7d22efd7fd795a8c3b3ca01f09023350c5
Go dependenciesOPAOpen Policy AgentRegoauthentication bypassbundle signature verification bypasspolicy tamperingrelease notessecurity updatesupply chain security
What happened
Open Policy Agent releases v1.21.3 and later include fixes and updates, most notably a security fix for a bundle signature verification bypass. Attackers able to modify bundle bytes or control the bundle/discovery delivery path could provide arbitrary policy and data to OPA despite configured signature verification. The issue affected configurations using a signing block without an explicit keyid and related embedding APIs. Releases also contain Go dependency/toolchain updates, parser/compiler fixes, authorization handling corrections, and new Rego functionality.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- open_policy_agent_opa_releases
- Record identifier
- 15dbff9ef974ec0d865e90f769687c7d22efd7fd795a8c3b3ca01f09023350c5
- Enrichment time
- 2026-10-30T08:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.