v1.21.1
2026-09-30T08:52:13Z•462869b596a928787ba869cb33033b3fa6d36b3121d1978d6cee1a1cdf7c2030
Compile APIGo vulnerabilitiesOPAOpen Policy AgentRegoSQL injectioncompiler regressionparser regressionpolicy-as-coderelease updates
What happened
Open Policy Agent releases v1.19.0–v1.21.1 include a security fix for SQL injection in the Compile API, Go standard-library vulnerability updates, and multiple compiler/parser regressions and feature changes. The SQL injection issue is the primary security-relevant item: caller-controlled dynamic policy keys could be emitted as unquoted SQL identifiers, enabling query manipulation. OPA v1.19.1 updates bundled Go to address several listed Go vulnerabilities. Later releases primarily fix correctness, parsing, and compiler stability issues.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- open_policy_agent_opa_releases
- Record identifier
- 462869b596a928787ba869cb33033b3fa6d36b3121d1978d6cee1a1cdf7c2030
- Enrichment time
- 2026-09-30T08:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.