v1.21.4
2026-10-24T08:52:13Z•18e5016433c0cd73fb12c9c958581833458f6e6303f8a43fdca741116adfc790
GHSA-g2pf-6v5v-qcc8Go dependency updatesOPAOpen Policy AgentRego compilerauthentication bypassauthorizationbundle signature verification bypasspolicy injectionsupply chain security
What happened
Open Policy Agent (OPA) v1.21.3 fixes a vulnerability that allowed attackers who could alter bundle bytes to bypass configured bundle signature verification and supply arbitrary policy and data. The issue affected configurations or integrations relying on a signing block without an explicit key ID; OPA v1.21.4 updates the Go toolchain, while other listed releases contain additional dependency, parser, compiler, and authorization-related fixes. No CVE identifier is provided; the vulnerability is tracked as GHSA-g2pf-6v5v-qcc8.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- open_policy_agent_opa_releases
- Record identifier
- 18e5016433c0cd73fb12c9c958581833458f6e6303f8a43fdca741116adfc790
- Enrichment time
- 2026-10-24T08:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.